Analysis
-
max time kernel
150s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
12-10-2024 10:32
Static task
static1
Behavioral task
behavioral1
Sample
V1.7.1-Fixed.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
V1.7.1-Fixed.exe
Resource
win10v2004-20241007-en
General
-
Target
V1.7.1-Fixed.exe
-
Size
385.3MB
-
MD5
2a8232328ce1284a136daed4eef7aa9f
-
SHA1
7fff50776487cc4b04a56d229f00cdf9dd81c32a
-
SHA256
1d0c2aa2a51d30c38f461d7af3709c14ff9c5e009509733c453233b5d243eb8e
-
SHA512
651d80097d01074875c69dddd396108348306799cdae4ce63a15c985cad051a617ea102fca07c25cff71feaf13deebfe62d6dfc89666c574df6746bff89e2614
-
SSDEEP
12582912:XZy50LHPZAtgAzt//N0vsqNbCFxocf5HIdE:XZdLvZAzlAxmD1Iu
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2644 Exela.exe 1936 Exela.exe 2132 Exela.exe 2348 Exela.exe 1984 Exela.exe 1988 Exela.exe 2972 Exela.exe 2196 Exela.exe 1260 Process not Found 940 Exela.exe 2416 Exela.exe 1060 Exela.exe 1772 Exela.exe 1552 Exela.exe 2808 Exela.exe 2804 Exela.exe 1312 Exela.exe 1528 Exela.exe 2692 Exela.exe 600 Exela.exe 2576 Exela.exe 2624 Exela.exe 1944 Exela.exe 1776 Exela.exe 1728 Exela.exe 896 Exela.exe 2668 Exela.exe 444 Exela.exe 2820 Exela.exe 1660 Exela.exe 1996 Exela.exe 1332 Exela.exe 1808 Exela.exe 2676 Exela.exe 2572 Exela.exe 2744 Exela.exe 2016 Exela.exe 1040 Exela.exe 1712 Exela.exe 2256 Exela.exe 2548 Exela.exe 2036 Exela.exe 1680 Exela.exe 1644 Exela.exe 2552 Exela.exe 2380 Exela.exe 1076 Exela.exe 3068 Exela.exe 2632 Exela.exe 2880 Exela.exe 1496 Exela.exe 1744 Exela.exe 2812 Exela.exe 2788 Exela.exe 2712 Exela.exe 2356 Exela.exe 1648 Exela.exe 2056 Exela.exe 2996 Exela.exe 2936 Exela.exe 2112 Exela.exe 808 Exela.exe 2852 Exela.exe 1048 Exela.exe -
Loads dropped DLL 64 IoCs
pid Process 2596 V1.7.1-Fixed.exe 2644 Exela.exe 1936 Exela.exe 1936 Exela.exe 1936 Exela.exe 1936 Exela.exe 1936 Exela.exe 1936 Exela.exe 1936 Exela.exe 2188 V1.7.1-Fixed.exe 2132 Exela.exe 2348 Exela.exe 2348 Exela.exe 2348 Exela.exe 2348 Exela.exe 2348 Exela.exe 2348 Exela.exe 2348 Exela.exe 2400 V1.7.1-Fixed.exe 1984 Exela.exe 1988 Exela.exe 1988 Exela.exe 1988 Exela.exe 1988 Exela.exe 1988 Exela.exe 1988 Exela.exe 1988 Exela.exe 2960 V1.7.1-Fixed.exe 2972 Exela.exe 2196 Exela.exe 2196 Exela.exe 2196 Exela.exe 2196 Exela.exe 2196 Exela.exe 2196 Exela.exe 2196 Exela.exe 1260 Process not Found 1016 V1.7.1-Fixed.exe 940 Exela.exe 2416 Exela.exe 2416 Exela.exe 2416 Exela.exe 2416 Exela.exe 2416 Exela.exe 2416 Exela.exe 2416 Exela.exe 1996 V1.7.1-Fixed.exe 1060 Exela.exe 1772 Exela.exe 1772 Exela.exe 1772 Exela.exe 1772 Exela.exe 1772 Exela.exe 1772 Exela.exe 1772 Exela.exe 1616 V1.7.1-Fixed.exe 1552 Exela.exe 2808 Exela.exe 2808 Exela.exe 2808 Exela.exe 2808 Exela.exe 2808 Exela.exe 2808 Exela.exe 2808 Exela.exe -
resource yara_rule behavioral1/files/0x000500000001a48f-105.dat upx behavioral1/memory/1936-107-0x000007FEF55F0000-0x000007FEF5A56000-memory.dmp upx behavioral1/memory/2348-211-0x000007FEF5180000-0x000007FEF55E6000-memory.dmp upx behavioral1/memory/1988-315-0x000007FEF4D10000-0x000007FEF5176000-memory.dmp upx behavioral1/memory/2196-410-0x000007FEF47A0000-0x000007FEF4C06000-memory.dmp upx behavioral1/files/0x000400000001d9ba-413.dat upx behavioral1/files/0x000400000001d9b8-412.dat upx behavioral1/files/0x000400000001d9be-415.dat upx behavioral1/files/0x000400000001d9bf-416.dat upx behavioral1/files/0x000400000001d9bc-414.dat upx behavioral1/files/0x000400000001d9c6-420.dat upx behavioral1/files/0x000400000001d9c8-421.dat upx behavioral1/files/0x000400000001d9ca-422.dat upx behavioral1/files/0x000400000001d9c4-419.dat upx behavioral1/files/0x000400000001d9ce-424.dat upx behavioral1/files/0x000400000001d9d4-426.dat upx behavioral1/files/0x000400000001d9d6-427.dat upx behavioral1/files/0x000400000001d9d8-428.dat upx behavioral1/files/0x000400000001d9da-429.dat upx behavioral1/files/0x000400000001d9cc-423.dat upx behavioral1/files/0x000400000001d9c2-418.dat upx behavioral1/files/0x000400000001d9c0-417.dat upx behavioral1/files/0x000400000001db78-481.dat upx behavioral1/files/0x000400000001db88-483.dat upx behavioral1/files/0x000400000001db99-486.dat upx behavioral1/files/0x000400000001db9d-487.dat upx behavioral1/files/0x000400000001dba9-490.dat upx behavioral1/files/0x000400000001dbb0-491.dat upx behavioral1/files/0x000400000001db90-485.dat upx behavioral1/files/0x000400000001dbcb-495.dat upx behavioral1/files/0x000400000001dbc7-494.dat upx behavioral1/files/0x000400000001dbb8-493.dat upx behavioral1/files/0x000400000001db8c-484.dat upx behavioral1/files/0x000400000001db83-482.dat upx behavioral1/memory/2416-496-0x000007FEF4330000-0x000007FEF4796000-memory.dmp upx behavioral1/memory/1772-582-0x000007FEF3EC0000-0x000007FEF4326000-memory.dmp upx behavioral1/memory/2808-668-0x000007FEF3A50000-0x000007FEF3EB6000-memory.dmp upx behavioral1/memory/2348-672-0x000007FEF5180000-0x000007FEF55E6000-memory.dmp upx behavioral1/memory/1312-755-0x000007FEF35E0000-0x000007FEF3A46000-memory.dmp upx behavioral1/memory/2692-841-0x000007FEF3070000-0x000007FEF34D6000-memory.dmp upx behavioral1/memory/2196-1006-0x000007FEF47A0000-0x000007FEF4C06000-memory.dmp upx behavioral1/memory/2576-1007-0x000007FEF2C00000-0x000007FEF3066000-memory.dmp upx behavioral1/memory/1944-1094-0x000007FEF2690000-0x000007FEF2AF6000-memory.dmp upx behavioral1/memory/1728-1180-0x000007FEF2120000-0x000007FEF2586000-memory.dmp upx behavioral1/memory/2668-1267-0x000007FEF1BB0000-0x000007FEF2016000-memory.dmp upx behavioral1/memory/2820-1354-0x000007FEF1640000-0x000007FEF1AA6000-memory.dmp upx behavioral1/memory/1996-1441-0x000007FEEE8D0000-0x000007FEEED36000-memory.dmp upx behavioral1/memory/1808-1528-0x000007FEEE460000-0x000007FEEE8C6000-memory.dmp upx behavioral1/memory/2572-1615-0x000007FEEDFF0000-0x000007FEEE456000-memory.dmp upx behavioral1/memory/2016-1702-0x000007FEEDB80000-0x000007FEEDFE6000-memory.dmp upx behavioral1/memory/1712-1789-0x000007FEED710000-0x000007FEEDB76000-memory.dmp upx behavioral1/memory/2548-1877-0x000007FEED2A0000-0x000007FEED706000-memory.dmp upx behavioral1/memory/1680-2042-0x000007FEECE30000-0x000007FEED296000-memory.dmp upx behavioral1/memory/2552-2130-0x000007FEEC9C0000-0x000007FEECE26000-memory.dmp upx -
Detects Pyinstaller 1 IoCs
resource yara_rule behavioral1/files/0x000a000000012255-2.dat pyinstaller -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2596 wrote to memory of 2644 2596 V1.7.1-Fixed.exe 30 PID 2596 wrote to memory of 2644 2596 V1.7.1-Fixed.exe 30 PID 2596 wrote to memory of 2644 2596 V1.7.1-Fixed.exe 30 PID 2596 wrote to memory of 2644 2596 V1.7.1-Fixed.exe 30 PID 2644 wrote to memory of 1936 2644 Exela.exe 31 PID 2644 wrote to memory of 1936 2644 Exela.exe 31 PID 2644 wrote to memory of 1936 2644 Exela.exe 31 PID 2596 wrote to memory of 2188 2596 V1.7.1-Fixed.exe 32 PID 2596 wrote to memory of 2188 2596 V1.7.1-Fixed.exe 32 PID 2596 wrote to memory of 2188 2596 V1.7.1-Fixed.exe 32 PID 2596 wrote to memory of 2188 2596 V1.7.1-Fixed.exe 32 PID 2188 wrote to memory of 2132 2188 V1.7.1-Fixed.exe 33 PID 2188 wrote to memory of 2132 2188 V1.7.1-Fixed.exe 33 PID 2188 wrote to memory of 2132 2188 V1.7.1-Fixed.exe 33 PID 2188 wrote to memory of 2132 2188 V1.7.1-Fixed.exe 33 PID 2132 wrote to memory of 2348 2132 Exela.exe 34 PID 2132 wrote to memory of 2348 2132 Exela.exe 34 PID 2132 wrote to memory of 2348 2132 Exela.exe 34 PID 2188 wrote to memory of 2400 2188 V1.7.1-Fixed.exe 35 PID 2188 wrote to memory of 2400 2188 V1.7.1-Fixed.exe 35 PID 2188 wrote to memory of 2400 2188 V1.7.1-Fixed.exe 35 PID 2188 wrote to memory of 2400 2188 V1.7.1-Fixed.exe 35 PID 2400 wrote to memory of 1984 2400 V1.7.1-Fixed.exe 36 PID 2400 wrote to memory of 1984 2400 V1.7.1-Fixed.exe 36 PID 2400 wrote to memory of 1984 2400 V1.7.1-Fixed.exe 36 PID 2400 wrote to memory of 1984 2400 V1.7.1-Fixed.exe 36 PID 1984 wrote to memory of 1988 1984 Exela.exe 37 PID 1984 wrote to memory of 1988 1984 Exela.exe 37 PID 1984 wrote to memory of 1988 1984 Exela.exe 37 PID 2400 wrote to memory of 2960 2400 V1.7.1-Fixed.exe 38 PID 2400 wrote to memory of 2960 2400 V1.7.1-Fixed.exe 38 PID 2400 wrote to memory of 2960 2400 V1.7.1-Fixed.exe 38 PID 2400 wrote to memory of 2960 2400 V1.7.1-Fixed.exe 38 PID 2960 wrote to memory of 2972 2960 V1.7.1-Fixed.exe 39 PID 2960 wrote to memory of 2972 2960 V1.7.1-Fixed.exe 39 PID 2960 wrote to memory of 2972 2960 V1.7.1-Fixed.exe 39 PID 2960 wrote to memory of 2972 2960 V1.7.1-Fixed.exe 39 PID 2972 wrote to memory of 2196 2972 Exela.exe 40 PID 2972 wrote to memory of 2196 2972 Exela.exe 40 PID 2972 wrote to memory of 2196 2972 Exela.exe 40 PID 2960 wrote to memory of 1016 2960 V1.7.1-Fixed.exe 41 PID 2960 wrote to memory of 1016 2960 V1.7.1-Fixed.exe 41 PID 2960 wrote to memory of 1016 2960 V1.7.1-Fixed.exe 41 PID 2960 wrote to memory of 1016 2960 V1.7.1-Fixed.exe 41 PID 1016 wrote to memory of 940 1016 V1.7.1-Fixed.exe 42 PID 1016 wrote to memory of 940 1016 V1.7.1-Fixed.exe 42 PID 1016 wrote to memory of 940 1016 V1.7.1-Fixed.exe 42 PID 1016 wrote to memory of 940 1016 V1.7.1-Fixed.exe 42 PID 940 wrote to memory of 2416 940 Exela.exe 43 PID 940 wrote to memory of 2416 940 Exela.exe 43 PID 940 wrote to memory of 2416 940 Exela.exe 43 PID 1016 wrote to memory of 1996 1016 V1.7.1-Fixed.exe 44 PID 1016 wrote to memory of 1996 1016 V1.7.1-Fixed.exe 44 PID 1016 wrote to memory of 1996 1016 V1.7.1-Fixed.exe 44 PID 1016 wrote to memory of 1996 1016 V1.7.1-Fixed.exe 44 PID 1996 wrote to memory of 1060 1996 V1.7.1-Fixed.exe 45 PID 1996 wrote to memory of 1060 1996 V1.7.1-Fixed.exe 45 PID 1996 wrote to memory of 1060 1996 V1.7.1-Fixed.exe 45 PID 1996 wrote to memory of 1060 1996 V1.7.1-Fixed.exe 45 PID 1060 wrote to memory of 1772 1060 Exela.exe 46 PID 1060 wrote to memory of 1772 1060 Exela.exe 46 PID 1060 wrote to memory of 1772 1060 Exela.exe 46 PID 1996 wrote to memory of 1616 1996 V1.7.1-Fixed.exe 47 PID 1996 wrote to memory of 1616 1996 V1.7.1-Fixed.exe 47
Processes
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1936
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2348
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1988
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2196
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"5⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1016 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:940 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2416
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"6⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"8⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1772
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"7⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"8⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1552 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"9⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2808
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"8⤵
- System Location Discovery: System Language Discovery
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"9⤵
- Executes dropped EXE
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"10⤵
- Executes dropped EXE
PID:1312
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"9⤵
- System Location Discovery: System Language Discovery
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"10⤵
- Executes dropped EXE
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"11⤵
- Executes dropped EXE
PID:2692
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"10⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"11⤵
- Executes dropped EXE
PID:600 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"12⤵
- Executes dropped EXE
PID:2576
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"11⤵PID:2556
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"12⤵
- Executes dropped EXE
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"13⤵
- Executes dropped EXE
PID:1944
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"12⤵PID:2120
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"13⤵
- Executes dropped EXE
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"14⤵
- Executes dropped EXE
PID:1728
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"13⤵
- System Location Discovery: System Language Discovery
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"14⤵
- Executes dropped EXE
PID:896 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"15⤵
- Executes dropped EXE
PID:2668
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"14⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"15⤵
- Executes dropped EXE
PID:444 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"16⤵
- Executes dropped EXE
PID:2820
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"15⤵
- System Location Discovery: System Language Discovery
PID:1848 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"16⤵
- Executes dropped EXE
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"17⤵
- Executes dropped EXE
PID:1996
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"16⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"17⤵
- Executes dropped EXE
PID:1332 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"18⤵
- Executes dropped EXE
PID:1808
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"17⤵PID:2524
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"18⤵
- Executes dropped EXE
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"19⤵
- Executes dropped EXE
PID:2572
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"18⤵
- System Location Discovery: System Language Discovery
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"19⤵
- Executes dropped EXE
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"20⤵
- Executes dropped EXE
PID:2016
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"19⤵
- System Location Discovery: System Language Discovery
PID:1848 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"20⤵
- Executes dropped EXE
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"21⤵
- Executes dropped EXE
PID:1712
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"20⤵PID:1452
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"21⤵
- Executes dropped EXE
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"22⤵
- Executes dropped EXE
PID:2548
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"21⤵
- System Location Discovery: System Language Discovery
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"22⤵
- Executes dropped EXE
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"23⤵
- Executes dropped EXE
PID:1680
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"22⤵
- System Location Discovery: System Language Discovery
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"23⤵
- Executes dropped EXE
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"24⤵
- Executes dropped EXE
PID:2552
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"23⤵PID:804
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"24⤵
- Executes dropped EXE
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"25⤵
- Executes dropped EXE
PID:1076
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"24⤵
- System Location Discovery: System Language Discovery
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"25⤵
- Executes dropped EXE
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"26⤵
- Executes dropped EXE
PID:2632
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"25⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"26⤵
- Executes dropped EXE
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"27⤵
- Executes dropped EXE
PID:1496
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"26⤵PID:800
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"27⤵
- Executes dropped EXE
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"28⤵
- Executes dropped EXE
PID:2812
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"27⤵PID:2968
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"28⤵
- Executes dropped EXE
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"29⤵
- Executes dropped EXE
PID:2712
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"28⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"29⤵
- Executes dropped EXE
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"30⤵
- Executes dropped EXE
PID:1648
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"29⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"30⤵
- Executes dropped EXE
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"31⤵
- Executes dropped EXE
PID:2996
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"30⤵PID:756
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"31⤵
- Executes dropped EXE
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"32⤵
- Executes dropped EXE
PID:2112
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"31⤵
- System Location Discovery: System Language Discovery
PID:692 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"32⤵
- Executes dropped EXE
PID:808 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"33⤵
- Executes dropped EXE
PID:2852
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"32⤵
- System Location Discovery: System Language Discovery
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"33⤵
- Executes dropped EXE
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"34⤵PID:864
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"33⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"34⤵PID:924
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"35⤵PID:2684
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"34⤵
- System Location Discovery: System Language Discovery
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"35⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"36⤵PID:1580
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"35⤵
- System Location Discovery: System Language Discovery
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"36⤵PID:2672
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"37⤵PID:2360
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"36⤵
- System Location Discovery: System Language Discovery
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"37⤵PID:572
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"38⤵PID:1036
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"37⤵PID:944
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"38⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"39⤵PID:656
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"38⤵
- System Location Discovery: System Language Discovery
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"39⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"40⤵PID:2152
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"39⤵PID:2212
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"40⤵PID:1156
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"41⤵PID:2920
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"40⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"41⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"42⤵PID:1628
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"41⤵PID:2064
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"42⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"43⤵PID:2824
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"42⤵
- System Location Discovery: System Language Discovery
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"43⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"44⤵PID:2528
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"43⤵
- System Location Discovery: System Language Discovery
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"44⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"45⤵PID:2888
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"44⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"45⤵PID:756
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"46⤵PID:2732
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"45⤵
- System Location Discovery: System Language Discovery
PID:1016 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"46⤵PID:2556
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"47⤵PID:576
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"46⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"47⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"48⤵PID:1884
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"47⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"48⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"49⤵PID:2124
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"48⤵PID:1892
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"49⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"50⤵PID:2000
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"49⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"50⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"51⤵PID:2560
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"50⤵
- System Location Discovery: System Language Discovery
PID:780 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"51⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"52⤵PID:2780
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"51⤵
- System Location Discovery: System Language Discovery
PID:876 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"52⤵PID:2212
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"53⤵PID:2924
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"52⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"53⤵PID:944
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"54⤵PID:2080
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"53⤵
- System Location Discovery: System Language Discovery
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"54⤵PID:1152
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"55⤵PID:1588
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"54⤵
- System Location Discovery: System Language Discovery
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"55⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"56⤵PID:2876
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"55⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"56⤵PID:2420
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"57⤵PID:2596
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"56⤵
- System Location Discovery: System Language Discovery
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"57⤵PID:560
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"58⤵PID:2864
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"57⤵PID:876
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"58⤵PID:612
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"59⤵PID:1892
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"58⤵PID:544
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"59⤵PID:1456
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"60⤵PID:2532
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"59⤵
- System Location Discovery: System Language Discovery
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"60⤵PID:2660
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"61⤵PID:2196
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"60⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"61⤵PID:1368
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"62⤵PID:1952
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"61⤵
- System Location Discovery: System Language Discovery
PID:992 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"62⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"63⤵PID:1612
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"62⤵
- System Location Discovery: System Language Discovery
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"63⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"64⤵PID:1992
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"63⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"64⤵PID:1056
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"65⤵PID:3188
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"64⤵PID:3204
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"65⤵PID:3224
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"66⤵PID:3584
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"65⤵
- System Location Discovery: System Language Discovery
PID:3604 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"66⤵PID:3628
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"67⤵PID:3988
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"66⤵PID:4008
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"67⤵PID:4032
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"68⤵PID:3244
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"67⤵PID:3208
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"68⤵PID:3660
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"69⤵PID:3608
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"68⤵
- System Location Discovery: System Language Discovery
PID:4064 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"69⤵PID:4088
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"70⤵PID:2656
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"69⤵PID:3316
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"70⤵PID:3324
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"71⤵PID:3704
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"70⤵
- System Location Discovery: System Language Discovery
PID:3840 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"71⤵PID:3792
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"72⤵PID:1756
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"71⤵
- System Location Discovery: System Language Discovery
PID:1448 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"72⤵PID:3092
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"73⤵PID:3468
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"72⤵PID:3536
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"73⤵PID:3544
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"74⤵PID:3976
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"73⤵PID:3612
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"74⤵PID:3204
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"75⤵PID:4080
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"74⤵
- System Location Discovery: System Language Discovery
PID:3444 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"75⤵PID:3440
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"76⤵PID:3780
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"75⤵
- System Location Discovery: System Language Discovery
PID:3772 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"76⤵PID:3912
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"77⤵PID:3148
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"76⤵PID:344
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"77⤵PID:3280
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"78⤵PID:3332
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"77⤵
- System Location Discovery: System Language Discovery
PID:3808 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"78⤵PID:3328
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"79⤵PID:3144
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"78⤵
- System Location Discovery: System Language Discovery
PID:3176 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"79⤵PID:404
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"80⤵PID:3716
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"79⤵PID:3848
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"80⤵PID:2540
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"81⤵PID:920
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"80⤵
- System Location Discovery: System Language Discovery
PID:3740 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"81⤵PID:3776
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"82⤵PID:888
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"81⤵
- System Location Discovery: System Language Discovery
PID:3176 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"82⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"83⤵PID:3732
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"82⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"83⤵PID:3684
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"84⤵PID:3968
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"83⤵
- System Location Discovery: System Language Discovery
PID:4076 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"84⤵PID:3872
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"85⤵PID:3880
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"84⤵
- System Location Discovery: System Language Discovery
PID:3964 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"85⤵PID:3560
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"86⤵PID:3764
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"85⤵PID:932
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"86⤵PID:3356
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"87⤵PID:1800
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"86⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"87⤵PID:3680
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"88⤵PID:4064
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"87⤵PID:3284
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"88⤵PID:3452
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"89⤵PID:3500
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"88⤵
- System Location Discovery: System Language Discovery
PID:3492 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"89⤵PID:3556
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"90⤵PID:932
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"89⤵PID:2840
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"90⤵PID:3424
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"91⤵PID:3284
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"90⤵
- System Location Discovery: System Language Discovery
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"91⤵PID:3096
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"92⤵PID:4060
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"91⤵
- System Location Discovery: System Language Discovery
PID:4072 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"92⤵PID:3508
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"93⤵PID:3940
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"92⤵PID:3672
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"93⤵PID:3728
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"94⤵PID:3076
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"93⤵PID:3932
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"94⤵PID:3540
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"95⤵PID:3456
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"94⤵PID:3536
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"95⤵PID:3344
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"96⤵PID:2416
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"95⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"96⤵PID:2264
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"97⤵PID:2064
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"96⤵
- System Location Discovery: System Language Discovery
PID:3304 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"97⤵PID:108
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"98⤵PID:3180
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"97⤵
- System Location Discovery: System Language Discovery
PID:3464 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"98⤵PID:3996
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"99⤵PID:4040
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"98⤵PID:3868
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"99⤵PID:3120
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"100⤵PID:3652
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"99⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"100⤵PID:3536
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"101⤵PID:2840
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"100⤵PID:3548
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"101⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"102⤵PID:3672
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"101⤵PID:3736
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"102⤵PID:3904
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"103⤵PID:4048
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"102⤵
- System Location Discovery: System Language Discovery
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"103⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"104⤵PID:3956
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"103⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"104⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"105⤵PID:2808
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"104⤵PID:3176
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"105⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"106⤵PID:3088
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"105⤵
- System Location Discovery: System Language Discovery
PID:3848 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"106⤵PID:4072
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"107⤵PID:4284
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"106⤵PID:4312
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"107⤵PID:4332
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"108⤵PID:4696
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"107⤵
- System Location Discovery: System Language Discovery
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"108⤵PID:4744
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"109⤵PID:5104
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"108⤵
- System Location Discovery: System Language Discovery
PID:4052 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"109⤵PID:4192
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"110⤵PID:4352
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"109⤵
- System Location Discovery: System Language Discovery
PID:4368 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"110⤵PID:4428
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"111⤵PID:4776
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"110⤵PID:4808
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"111⤵PID:4828
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"112⤵PID:4256
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"111⤵
- System Location Discovery: System Language Discovery
PID:4228 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"112⤵PID:4156
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"113⤵PID:4408
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"112⤵
- System Location Discovery: System Language Discovery
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"113⤵PID:4504
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"114⤵PID:4920
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"113⤵PID:4872
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"114⤵PID:4968
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"115⤵PID:1716
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"114⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"115⤵PID:4136
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"116⤵PID:4664
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"115⤵
- System Location Discovery: System Language Discovery
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"116⤵PID:4624
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"117⤵PID:4740
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"116⤵PID:4240
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"117⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"118⤵PID:4440
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"117⤵PID:4400
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"118⤵PID:4124
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"119⤵PID:2164
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"118⤵
- System Location Discovery: System Language Discovery
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"119⤵PID:5012
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"120⤵PID:2300
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"119⤵PID:4936
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"120⤵PID:4272
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"121⤵PID:4568
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"120⤵
- System Location Discovery: System Language Discovery
PID:628 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"121⤵PID:4764
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"122⤵PID:1528
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-