Overview

overview

7

Static

static

3

2026-09-30...op.exe

windows10-2004-x64

7

2026-09-30...op.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    142s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    01/10/2026, 10:31

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
  • Size 5.4MB
  • Sample261001-mkrnjayyat
  • SHA256 05802a4a2f364bcdfd5f05381033d483c250fe5a4f1d4bbf674fd7464ebd6bc9
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecution

Malware Config

Signatures

  • Executes dropped EXE 64 IoCs
  • Enumerates connected drives 3 TTPs 44 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Program crash 1 IoCs
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:5688
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA4D1.bat
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3804
      • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
        "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:2896
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA81D.bat
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:5440
          • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
            "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:1812
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB859.bat
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:5508
              • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                7⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:1120
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC7AB.bat
                  8⤵
                  • Suspicious use of WriteProcessMemory
                  PID:5080
                  • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                    "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                    9⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • Suspicious use of WriteProcessMemory
                    PID:3744
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD7A9.bat
                      10⤵
                      • Executes a command shell one-liner
                      • Suspicious use of WriteProcessMemory
                      PID:3264
                      • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                        "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                        11⤵
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of WriteProcessMemory
                        PID:1996
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE2E4.bat
                          12⤵
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of WriteProcessMemory
                          PID:3192
                          • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                            "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                            13⤵
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            • Suspicious use of WriteProcessMemory
                            PID:5776
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEBED.bat
                              14⤵
                              • Suspicious use of WriteProcessMemory
                              PID:4908
                              • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                15⤵
                                • Executes dropped EXE
                                • Drops file in Windows directory
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of WriteProcessMemory
                                PID:6104
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF2A3.bat
                                  16⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:1448
                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Suspicious use of WriteProcessMemory
                                    PID:2588
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF7F3.bat
                                      18⤵
                                      • Executes a command shell one-liner
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of WriteProcessMemory
                                      PID:2720
                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Suspicious use of WriteProcessMemory
                                        PID:2604
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFDCF.bat
                                          20⤵
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious use of WriteProcessMemory
                                          PID:1316
                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Suspicious use of WriteProcessMemory
                                            PID:4920
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF34.bat
                                              22⤵
                                              • Executes a command shell one-liner
                                              • Suspicious use of WriteProcessMemory
                                              PID:948
                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Drops file in Windows directory
                                                • Suspicious use of WriteProcessMemory
                                                PID:3368
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1723.bat
                                                  24⤵
                                                  • Executes a command shell one-liner
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:3252
                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:720
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1B59.bat
                                                      26⤵
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:2256
                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:5928
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1FDD.bat
                                                          28⤵
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:3336
                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:4860
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a24B0.bat
                                                              30⤵
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:856
                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Drops file in Windows directory
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:4304
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2B86.bat
                                                                  32⤵
                                                                  • Executes a command shell one-liner
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:5256
                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • System Location Discovery: System Language Discovery
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:3316
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a351B.bat
                                                                      34⤵
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:1744
                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:4432
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3A3B.bat
                                                                          36⤵
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:1568
                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:4088
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3E43.bat
                                                                              38⤵
                                                                              • Executes a command shell one-liner
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:5388
                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:4316
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a41DD.bat
                                                                                  40⤵
                                                                                  • Executes a command shell one-liner
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:1612
                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Drops file in Windows directory
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:1300
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4373.bat
                                                                                      42⤵
                                                                                      • Executes a command shell one-liner
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:3932
                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Drops file in Windows directory
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:3164
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a44EA.bat
                                                                                          44⤵
                                                                                          • Executes a command shell one-liner
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:4056
                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Drops file in Windows directory
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:5512
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4670.bat
                                                                                              46⤵
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:5076
                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Drops file in Windows directory
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:2764
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a47C8.bat
                                                                                                  48⤵
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:5852
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:3772
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4910.bat
                                                                                                      50⤵
                                                                                                      • Executes a command shell one-liner
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:2796
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:5364
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4A78.bat
                                                                                                          52⤵
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:3848
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Drops file in Windows directory
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:4340
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4BEF.bat
                                                                                                              54⤵
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:812
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Drops file in Windows directory
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:5908
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4D66.bat
                                                                                                                  56⤵
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:1420
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Drops file in Windows directory
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:3440
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4EFC.bat
                                                                                                                      58⤵
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:1852
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        PID:5352
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5054.bat
                                                                                                                          60⤵
                                                                                                                          • Executes a command shell one-liner
                                                                                                                          PID:4364
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                            PID:944
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a51EA.bat
                                                                                                                              62⤵
                                                                                                                                PID:1212
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                  63⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • Drops file in Windows directory
                                                                                                                                  PID:1632
                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5342.bat
                                                                                                                                    64⤵
                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                    PID:4548
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                      65⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      • Drops file in Windows directory
                                                                                                                                      PID:2384
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a548A.bat
                                                                                                                                        66⤵
                                                                                                                                          PID:4560
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                            67⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                            PID:1596
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a55F1.bat
                                                                                                                                              68⤵
                                                                                                                                                PID:1388
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                  69⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  PID:2484
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5739.bat
                                                                                                                                                    70⤵
                                                                                                                                                      PID:4260
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                        71⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                        PID:1964
                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a58A1.bat
                                                                                                                                                          72⤵
                                                                                                                                                            PID:3688
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                              73⤵
                                                                                                                                                                PID:4220
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5A08.bat
                                                                                                                                                                  74⤵
                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                  PID:1392
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                    75⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                    PID:1968
                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5B8F.bat
                                                                                                                                                                      76⤵
                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                      PID:1628
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                        77⤵
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                        PID:4120
                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5D63.bat
                                                                                                                                                                          78⤵
                                                                                                                                                                            PID:4672
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                              79⤵
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                              PID:4512
                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5EEA.bat
                                                                                                                                                                                80⤵
                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                PID:3944
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                  81⤵
                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                  PID:1240
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6023.bat
                                                                                                                                                                                    82⤵
                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                    PID:5224
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                      83⤵
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      PID:4888
                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a616B.bat
                                                                                                                                                                                        84⤵
                                                                                                                                                                                          PID:2328
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                            85⤵
                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                            PID:2568
                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6284.bat
                                                                                                                                                                                              86⤵
                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                              PID:5484
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                87⤵
                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                PID:5452
                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a63BC.bat
                                                                                                                                                                                                  88⤵
                                                                                                                                                                                                    PID:2100
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                      89⤵
                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                      PID:5384
                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6514.bat
                                                                                                                                                                                                        90⤵
                                                                                                                                                                                                          PID:1864
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                            91⤵
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            PID:792
                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a666C.bat
                                                                                                                                                                                                              92⤵
                                                                                                                                                                                                                PID:3292
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                  93⤵
                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                  PID:4288
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a67B4.bat
                                                                                                                                                                                                                    94⤵
                                                                                                                                                                                                                      PID:3156
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                        95⤵
                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                        PID:2624
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a695A.bat
                                                                                                                                                                                                                          96⤵
                                                                                                                                                                                                                            PID:4408
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                              97⤵
                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                              PID:3208
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6B4E.bat
                                                                                                                                                                                                                                98⤵
                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                PID:3408
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                  99⤵
                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                  PID:5616
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6D52.bat
                                                                                                                                                                                                                                    100⤵
                                                                                                                                                                                                                                      PID:2640
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                        101⤵
                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                        PID:484
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6FB3.bat
                                                                                                                                                                                                                                          102⤵
                                                                                                                                                                                                                                            PID:5320
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                              103⤵
                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                              PID:2620
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a737C.bat
                                                                                                                                                                                                                                                104⤵
                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                PID:904
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                  105⤵
                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                  PID:6136
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7550.bat
                                                                                                                                                                                                                                                    106⤵
                                                                                                                                                                                                                                                      PID:1464
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                        107⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                        PID:3012
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7735.bat
                                                                                                                                                                                                                                                          108⤵
                                                                                                                                                                                                                                                            PID:4196
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                              109⤵
                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                              PID:1208
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a78CB.bat
                                                                                                                                                                                                                                                                110⤵
                                                                                                                                                                                                                                                                  PID:2084
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                    111⤵
                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                    PID:1404
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7A90.bat
                                                                                                                                                                                                                                                                      112⤵
                                                                                                                                                                                                                                                                        PID:6060
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                          113⤵
                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                          PID:5140
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7C17.bat
                                                                                                                                                                                                                                                                            114⤵
                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                            PID:1168
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                              115⤵
                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                              PID:2480
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7DBD.bat
                                                                                                                                                                                                                                                                                116⤵
                                                                                                                                                                                                                                                                                  PID:3600
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                    117⤵
                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                    PID:5716
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7F82.bat
                                                                                                                                                                                                                                                                                      118⤵
                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                      PID:1624
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                        119⤵
                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                        PID:3120
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8118.bat
                                                                                                                                                                                                                                                                                          120⤵
                                                                                                                                                                                                                                                                                            PID:4592
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                              121⤵
                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                              PID:5832
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a829F.bat
                                                                                                                                                                                                                                                                                                122⤵
                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                PID:5824
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                  123⤵
                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                  PID:2360
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a83F6.bat
                                                                                                                                                                                                                                                                                                    124⤵
                                                                                                                                                                                                                                                                                                      PID:4044
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                        125⤵
                                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                        PID:2712
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a857D.bat
                                                                                                                                                                                                                                                                                                          126⤵
                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                          PID:2284
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                            127⤵
                                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                            PID:6100
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8713.bat
                                                                                                                                                                                                                                                                                                              128⤵
                                                                                                                                                                                                                                                                                                                PID:2040
                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                  129⤵
                                                                                                                                                                                                                                                                                                                    PID:3668
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a886B.bat
                                                                                                                                                                                                                                                                                                                      130⤵
                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                      PID:2636
                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                        131⤵
                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                        PID:1948
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8A4F.bat
                                                                                                                                                                                                                                                                                                                          132⤵
                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                          PID:3828
                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                            133⤵
                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                            PID:2800
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8C15.bat
                                                                                                                                                                                                                                                                                                                              134⤵
                                                                                                                                                                                                                                                                                                                                PID:5136
                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                  135⤵
                                                                                                                                                                                                                                                                                                                                    PID:6016
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8DAB.bat
                                                                                                                                                                                                                                                                                                                                      136⤵
                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                      PID:1508
                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                        137⤵
                                                                                                                                                                                                                                                                                                                                          PID:5212
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8F03.bat
                                                                                                                                                                                                                                                                                                                                            138⤵
                                                                                                                                                                                                                                                                                                                                              PID:2996
                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                139⤵
                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                PID:3116
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a904B.bat
                                                                                                                                                                                                                                                                                                                                                  140⤵
                                                                                                                                                                                                                                                                                                                                                    PID:5868
                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                      141⤵
                                                                                                                                                                                                                                                                                                                                                        PID:2448
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a91B2.bat
                                                                                                                                                                                                                                                                                                                                                          142⤵
                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                          PID:4284
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                            143⤵
                                                                                                                                                                                                                                                                                                                                                              PID:2760
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9329.bat
                                                                                                                                                                                                                                                                                                                                                                144⤵
                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                PID:5284
                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                  145⤵
                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                  PID:1312
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9471.bat
                                                                                                                                                                                                                                                                                                                                                                    146⤵
                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                    PID:4228
                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                      147⤵
                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                      PID:1452
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a95C9.bat
                                                                                                                                                                                                                                                                                                                                                                        148⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:5600
                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                            149⤵
                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                            PID:4892
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9730.bat
                                                                                                                                                                                                                                                                                                                                                                              150⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:3240
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                  151⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                  PID:5228
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a98B7.bat
                                                                                                                                                                                                                                                                                                                                                                                    152⤵
                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                    PID:4776
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                      153⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:240
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a99D0.bat
                                                                                                                                                                                                                                                                                                                                                                                          154⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:4840
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                              155⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                              PID:5560
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9B28.bat
                                                                                                                                                                                                                                                                                                                                                                                                156⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                PID:2124
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                  157⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                  PID:3348
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9C80.bat
                                                                                                                                                                                                                                                                                                                                                                                                    158⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                    PID:5740
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                      159⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:980
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9DD7.bat
                                                                                                                                                                                                                                                                                                                                                                                                          160⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                          PID:4500
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                            161⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:5396
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9F3F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                162⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4756
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                    163⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5912
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA0E5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                        164⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5244
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                          165⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2920
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA24C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                              166⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5660
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                  167⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6048
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA3C3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    168⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4748
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                      169⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3576
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA50B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                        170⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2784
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                          171⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:716
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA663.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                            172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:8
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                              173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1932
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA7BB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                  174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5972
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                    175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5664
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA912.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                      176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2308
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                          177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4976
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAA2C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                            178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1408
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4588
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAB74.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6068
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1752
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aACBC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5252
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1468
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aADE5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2804
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2968
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAF3D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5072
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1808
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB094.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:424
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3024
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB1AE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4468
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5056
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB315.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:472
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1684
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB41F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5756
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3260
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB538.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4940
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3860
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB670.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4684
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1284
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB77A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:700
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3740
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB893.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5368
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5748
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB9BC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3296
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2392
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBB14.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3936
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4648
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBC5C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6004
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5792
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBD66.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5404
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2000
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBE6F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2196
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1680
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBF79.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2916
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:248
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC0B1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4068
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4796
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC209.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5948
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2752
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC351.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2164
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2444
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC47A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5052
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3844
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC5C2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          224⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6124
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            225⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3148
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC6FB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              226⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4712
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                227⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4348
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC7E5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  228⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4804
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    229⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6032
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC93D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      230⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4276
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          231⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3684
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCA37.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            232⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1816
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              233⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1292
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCB50.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  234⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3476
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    235⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2572
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCCB7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      236⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2072
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        237⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5124
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCDF0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            238⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5576
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                239⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4880
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCEDA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    240⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1840
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      241⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3044
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD003.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          242⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1836
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              243⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5028
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD0CE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  244⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4240
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    245⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4660
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD207.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      246⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5952
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          247⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5012
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD301.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            248⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3008
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                249⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4988
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD41A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  250⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    251⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1940
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD572.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      252⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5988
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          253⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1660
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD66C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            254⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:556
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                255⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4140
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD7D3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    256⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4544
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        257⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5248
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD8CD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            258⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3384
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                259⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5896
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD9D7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    260⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3816
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        261⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5060
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDAE0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            262⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:572
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              263⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2428
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDBEA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  264⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5288
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      265⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3852
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDCF4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        266⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4924
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          267⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3160
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDE1D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              268⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5672
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                269⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2292
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDF17.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  270⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4092
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    271⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1776
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE03F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        272⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3204
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            273⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4160
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE149.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              274⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4536
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  275⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2104
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE272.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      276⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2984
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          277⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5684
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE36C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            278⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6092
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                279⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5772
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE447.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  280⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4728
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      281⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1160
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE550.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        282⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4360
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          283⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1072
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE66A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            284⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3032
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                285⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5196
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE773.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    286⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2616
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      287⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2192
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE88C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        288⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4252
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            289⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1620
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE977.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              290⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1200
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                291⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2052
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEA32.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    292⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:620
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      293⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2680
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEB0D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          294⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5216
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              295⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3484
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEBE8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                296⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2092
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    297⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2288
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aECC3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        298⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1348
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          299⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4780
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEDDC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              300⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:808
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                301⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3304
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEE97.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    302⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2184
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        303⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2992
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEF72.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            304⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3124
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                305⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2076
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF03D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  306⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5612
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      307⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4812
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF108.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        308⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4824
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            309⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4256
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF1C4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              310⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4436
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                311⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5500
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF2BE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  312⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4164
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      313⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1476
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF36A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          314⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3388
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            315⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1020
                                                                                                                                                                                                                                                      • C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                        C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        • Enumerates connected drives
                                                                                                                                                                                                                                                        • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                        PID:1636
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                          net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                          9⤵
                                                                                                                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                          PID:5464
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                            C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                            10⤵
                                                                                                                                                                                                                                                              PID:5612
                                                                                                                                                                                                                                            • C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                              C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                              • Enumerates connected drives
                                                                                                                                                                                                                                              • Drops file in Program Files directory
                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                              • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                              PID:5984
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                PID:5940
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                  PID:6116
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 5984 -s 992
                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                • Program crash
                                                                                                                                                                                                                                                PID:3248
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5984 -ip 5984
                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                              PID:5216

                                                                                                                                                                                                                                            Network

                                                                                                                                                                                                                                                  MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                  Replay Monitor

                                                                                                                                                                                                                                                  Loading Replay Monitor...

                                                                                                                                                                                                                                                  Downloads

                                                                                                                                                                                                                                                  $$a1723.bat
                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a1723.bat
                                                                                                                                                                                                                                                  • Size 776B
                                                                                                                                                                                                                                                  • SHA256 64d5ca87c139496b7487039cd8bb05a980061bf2c4001ce9e3442f1cdda6e292
                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                  $$a1B59.bat
                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a1B59.bat
                                                                                                                                                                                                                                                  • Size 776B
                                                                                                                                                                                                                                                  • SHA256 59b2339830a0368b106b366fe8992942a146da17533044c30acf1b468e71ca09
                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                  $$a1FDD.bat
                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a1FDD.bat
                                                                                                                                                                                                                                                  • Size 776B
                                                                                                                                                                                                                                                  • SHA256 47385c29945de87361b2b49cac15a73670447b6170bd89797b13ac929925e59c
                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                  $$a24B0.bat
                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a24B0.bat
                                                                                                                                                                                                                                                  • Size 776B
                                                                                                                                                                                                                                                  • SHA256 42ff8fe1d5619e6f900e13928e8bc7c04ba31b137081b3e5373dea73d3b6b7ff
                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                  $$a2B86.bat
                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a2B86.bat
                                                                                                                                                                                                                                                  • Size 776B
                                                                                                                                                                                                                                                  • SHA256 7fa2e0fd3459e3c0d8a7a6d60925d027b875dfca403f4ec3173a6d6a0169a9a4
                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                  $$a351B.bat
                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a351B.bat
                                                                                                                                                                                                                                                  • Size 776B
                                                                                                                                                                                                                                                  • SHA256 e1a5343b3a0f0f50882f7eaa3e487d981d2de7193d4b51b7069fc7d8c5480e8c
                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                  $$a3A3B.bat
                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a3A3B.bat
                                                                                                                                                                                                                                                  • Size 776B
                                                                                                                                                                                                                                                  • SHA256 8a3506acf22e08fe00c55eefb88ce04807f71953845cde9c46af04d3db718c69
                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                  $$aA4D1.bat
                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$aA4D1.bat
                                                                                                                                                                                                                                                  • Size 776B
                                                                                                                                                                                                                                                  • SHA256 1de977d3fb949367a558d534981a0924bb03f808e1690f634bf318ae397b817b
                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                  $$aA81D.bat
                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$aA81D.bat
                                                                                                                                                                                                                                                  • Size 776B
                                                                                                                                                                                                                                                  • SHA256 4f0ace0fb07cf55460b889d1b5f91c4151501c84d1b3213e2255ee9f42e1567b
                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                  $$aB859.bat
                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$aB859.bat
                                                                                                                                                                                                                                                  • Size 776B
                                                                                                                                                                                                                                                  • SHA256 02d2f272609e576089af08b40da1a529e77b9fd1c1d0c3bc0d8994ce5f445f5e
                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                  $$aC7AB.bat
                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$aC7AB.bat
                                                                                                                                                                                                                                                  • Size 776B
                                                                                                                                                                                                                                                  • SHA256 bb6d19618a8552c6ef09b0ba99ff1326d36c89195e4209c30c6c7f2a8dc4c496
                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                  $$aD7A9.bat
                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$aD7A9.bat
                                                                                                                                                                                                                                                  • Size 776B
                                                                                                                                                                                                                                                  • SHA256 520ba1bfd26219dce7aca9bbb1ee0832aa8ced06dc654702a6e91ae3bc8e9db6
                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                  $$aE2E4.bat
                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$aE2E4.bat
                                                                                                                                                                                                                                                  • Size 776B
                                                                                                                                                                                                                                                  • SHA256 130b94702082b395ac0b89a1c707eeed7853d39fdc3de973f863019a2a04ab56
                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                  $$aEBED.bat
                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$aEBED.bat
                                                                                                                                                                                                                                                  • Size 776B
                                                                                                                                                                                                                                                  • SHA256 288015b8627ff707778c0b464c091190025535c7ca7ee1959ec7b3c635f38e26
                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                  $$aF2A3.bat
                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$aF2A3.bat
                                                                                                                                                                                                                                                  • Size 776B
                                                                                                                                                                                                                                                  • SHA256 c3d2ebbafe8ca08c659565dfef8066f648d66c7d314ee68842828a20d7be8107
                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                  $$aF34.bat
                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$aF34.bat
                                                                                                                                                                                                                                                  • Size 775B
                                                                                                                                                                                                                                                  • SHA256 581c7e45ed2f77143d98a806a4467c2c76cf222a27835bdf7650a7332c9b0e9c
                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                  $$aF7F3.bat
                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$aF7F3.bat
                                                                                                                                                                                                                                                  • Size 776B
                                                                                                                                                                                                                                                  • SHA256 d5e53c633ef21f982d05c596fb31cf6105a6f2e9787277ad7a656bff747b6d88
                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                  $$aFDCF.bat
                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$aFDCF.bat
                                                                                                                                                                                                                                                  • Size 776B
                                                                                                                                                                                                                                                  • SHA256 92e4192dd080689eef68d83cd738f7d727cb92e9a50852c48223273f802b1ad9
                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                  2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                  • Size 5.4MB
                                                                                                                                                                                                                                                  • SHA256 a16bd81d8b0e04a2ebf64135ec0a21009dd3f39eccc5268d24b9c05b44a2995d
                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                  2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                  • Size 5.3MB
                                                                                                                                                                                                                                                  • SHA256 f15547593fd9b8b22a4800d55324426773495e597fa1f1245e21a614491971e4
                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                  2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                  • Size 5.4MB
                                                                                                                                                                                                                                                  • SHA256 b71ded762277a6a29bb25d1fc076e4f8b302f784b90a54b5704ceccbfa5a1667
                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                  2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                  • Size 5.2MB
                                                                                                                                                                                                                                                  • SHA256 f45fa1a70292a9cceae484a85d642eb0b8c1dc9b5211e9469ce0e1da07288b6a
                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                  2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                  • Size 5.3MB
                                                                                                                                                                                                                                                  • SHA256 aeea6f43d331680f3d22326687e8c34ffdad03ed42feb37565c3e9ba674a5831
                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                  2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                  • Size 5.2MB
                                                                                                                                                                                                                                                  • SHA256 0f3243f8761507172a0c11180ead76831851bd24d287d60ef612369a671a7921
                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                  2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                  • Size 5.3MB
                                                                                                                                                                                                                                                  • SHA256 14fe5ec4a16a84b564b5635984cbdfd3f2e8d87a1f964f2ca2f103a83d544ecb
                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                  2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                  • Size 5.1MB
                                                                                                                                                                                                                                                  • SHA256 66bbc3aa33f95d798bc950e0d10ddbd855ff132b63d520030fb15988b231f748
                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                  2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                  • Size 5.2MB
                                                                                                                                                                                                                                                  • SHA256 94180b987ef238e451a550aa327d7c7172790061c7bdcb82bcf7d44e7933cb68
                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                  2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                  • Size 5.0MB
                                                                                                                                                                                                                                                  • SHA256 91edfd065dc6a031c9b217d17010c45f7ea799f934bf5b00b65d33d3904b72d1
                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                  2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                  • Size 5.1MB
                                                                                                                                                                                                                                                  • SHA256 97362b25249f230ce4846b44e3d7b9a72135a20dfbdf9554ad2e6408a442b874
                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                  2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                  • Size 5.0MB
                                                                                                                                                                                                                                                  • SHA256 080c9a6569610b50bfbc61d315aaff27f30f4f8da59d1c53dc858c92ceecdb7c
                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                  2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                  • Size 5.1MB
                                                                                                                                                                                                                                                  • SHA256 4d6c6652c92a0b76d29044b5673caffbde10ee72e109211fb6a776f56961331b
                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                  2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                  • Size 4.9MB
                                                                                                                                                                                                                                                  • SHA256 e1e6a21f924ddbb1c67a572f595743d9e4fc8c688a92dc07fb7fb834eb314162
                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                  2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                  • Size 5.0MB
                                                                                                                                                                                                                                                  • SHA256 031172f3a628a5a2d472879b7e8c302048c3f68572c3ff09671ab47ca0afca06
                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                  2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                  • Size 4.9MB
                                                                                                                                                                                                                                                  • SHA256 d8d242c2bf1e81e4361c93142dc83063b5fdc66d0ee48bcc914025fbe6f660bc
                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                  2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                  • Size 5.0MB
                                                                                                                                                                                                                                                  • SHA256 b229367b193383ae20243823e3867c45ac3c721590d7125f87b16ef6e08f5c75
                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                  2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\2026-09-30_8c82510032cc29a3be7b885bcfa887b1_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                  • Size 4.9MB
                                                                                                                                                                                                                                                  • SHA256 8d63c950cebf701c3fc834eb6c9476a380bffa14eefc42dcdfad4d5cba4bab3e
                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                  Dll.dll
                                                                                                                                                                                                                                                  • Path C:\Windows\Dll.dll
                                                                                                                                                                                                                                                  • Size 68KB
                                                                                                                                                                                                                                                  • SHA256 58902ae17338af4211e7e21eddb09671507b48740fa7056b9b7f7ab307da0168
                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                  Logo1_.exe
                                                                                                                                                                                                                                                  • Path C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                  • Size 32KB
                                                                                                                                                                                                                                                  • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                  _desktop.ini
                                                                                                                                                                                                                                                  • Path F:\$RECYCLE.BIN\S-1-5-21-1404337215-1550464601-2805570857-1000\_desktop.ini
                                                                                                                                                                                                                                                  • Size 9B
                                                                                                                                                                                                                                                  • SHA256 4847b97cf00df4928ed5c4f8ca2a0ead0bf62534d7e9c6ba23326137ddbb5c6f
                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                  memory/240-2043-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/248-2230-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/484-1897-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/716-2097-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/720-1691-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/792-1872-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/944-1800-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/980-2061-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/1072-2435-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/1120-1610-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/1160-2429-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/1208-1917-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/1240-1846-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/1284-2182-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/1292-2284-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/1300-1750-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/1312-2019-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/1404-1922-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/1452-2025-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/1468-2133-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/1596-1815-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/1620-2453-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/1632-1805-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/1636-1643-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/1636-1678-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/1636-1634-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/1660-2344-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/1680-2224-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/1684-2164-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/1752-2127-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/1776-2399-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/1808-2145-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/1812-46-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/1932-2103-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/1940-2338-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/1948-1976-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/1964-1821-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/1968-1831-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/1996-1632-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/2000-2218-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/2052-2459-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/2076-2501-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/2104-2411-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/2192-2447-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/2288-2477-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/2292-2393-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/2360-1952-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/2384-1810-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/2392-2200-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/2428-2375-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/2444-2248-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/2448-2007-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/2480-1932-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/2484-1820-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/2568-1856-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/2572-2290-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/2588-1658-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/2604-1666-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/2620-1902-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/2624-1882-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/2680-2465-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/2712-1958-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/2752-2242-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/2760-2013-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/2764-1765-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/2800-1983-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/2896-23-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/2920-2079-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/2968-2139-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/2992-2495-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/3012-1912-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/3024-2151-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/3044-2308-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/3116-2001-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/3120-1942-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/3148-2260-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/3160-2387-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/3164-1755-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/3208-1887-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/3260-2170-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/3304-2489-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/3316-1723-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/3348-2055-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/3368-1683-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/3440-1790-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/3484-2471-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/3576-2091-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/3668-1970-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/3684-2278-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/3740-2188-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/3744-1624-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/3772-1770-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/3844-2254-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/3852-2381-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/3860-2176-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/4088-1740-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/4120-1836-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/4140-2350-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/4160-2405-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/4220-1826-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/4288-1877-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/4304-1715-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/4316-1745-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/4340-1780-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/4348-2266-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/4432-1731-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/4512-1841-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/4588-2121-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/4648-2206-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/4660-2320-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/4780-2483-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/4796-2236-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/4812-2507-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/4860-1707-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/4880-2302-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/4888-1851-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/4892-2031-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/4920-1674-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/4976-2115-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/4988-2332-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/5012-2326-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/5028-2314-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/5056-2158-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/5060-2369-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/5124-2296-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/5140-1927-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/5196-2441-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/5212-1995-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/5228-2037-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/5248-2356-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/5352-1795-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/5364-1775-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/5384-1867-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/5396-2067-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/5452-1861-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/5512-1760-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/5560-2049-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/5616-1892-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/5664-2109-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/5684-2417-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/5688-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/5688-13-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/5716-1937-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/5748-2194-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/5772-2423-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/5776-1641-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/5792-2212-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/5832-1947-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/5896-2363-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/5908-1785-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/5912-2073-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/5928-1699-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/5984-1596-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/5984-10-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/6016-1989-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/6032-2272-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/6048-2085-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/6100-1964-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/6104-1650-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/6136-1907-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download