Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

Solara.exe

windows10-ltsc 2021-x64

10

Solara.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    113s
  • max time network
    152s
  • platform
    windows10-ltsc 2021_x64
  • resource
    win10ltsc2021-20241211-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20241211-enlocale:en-usos:windows10-ltsc 2021-x64system
  • submitted
    12/01/2025, 22:09

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Solara.exe

  • Size

    13.5MB

  • MD5

    6ca6ea858de3f4203df8b8c5c218ad17

  • SHA1

    71a0778b88469b8a62e472f8827465e2e68fbec6

  • SHA256

    421ed8931f574d6dcc86eb7fa2fbb0fc9069aebf22dbc0c4c0f341c7864d3784

  • SHA512

    e6324cd5c130e86038666ed4882a4a7f37f168c771bf6ef86aed19eb6733c2a8a875a01271cd1d82d193c665dbaaf6e21cf12c2ced18d20a1cfb2712f9e0ff00

  • SSDEEP

    393216:NsEANEX3gBGYVwwoE0VhUqE7SlO9h4m/a360m:NhIEX3kGN/XBEWs4EA60m

Score
10/10
exelastealercollectiondefense_evasiondiscoveryevasionexecutionpersistenceprivilege_escalationpyinstallerspywarestealerupx

Malware Config

Signatures

  • Exela Stealer

    Exela Stealer is an open source stealer originally written in .NET and later transitioned to Python that was first observed in August 2023.

    stealerexelastealer
  • Exelastealer family
    exelastealer
  • Grants admin privileges 1 TTPs

    Uses net.exe to modify the user's privileges.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 64 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Modifies Windows Firewall 2 TTPs 2 IoCs
    evasion
  • Checks computer location settings 2 TTPs 34 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Clipboard Data 1 TTPs 2 IoCs

    Adversaries may collect data stored in the clipboard from users copying information within or between applications.

    collection
  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 64 IoCs
    persistence
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Network Service Discovery 1 TTPs 2 IoCs

    Attempt to gather information on host's network.

    discovery
  • Enumerates processes with tasklist 1 TTPs 5 IoCs
    discovery
  • Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs
    defense_evasion
  • UPX packed file 64 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Detects Pyinstaller 1 IoCs
    pyinstaller
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Permission Groups Discovery: Local Groups 1 TTPs

    Attempt to find local system groups and permission settings.

    discovery
  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

    discovery
  • System Network Connections Discovery 1 TTPs 1 IoCs

    Attempt to get a listing of network connections.

    discovery
  • Collects information from the system 1 TTPs 1 IoCs

    Uses WMIC.exe to find detailed system information.

  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Gathers network information 2 TTPs 2 IoCs

    Uses commandline utility to view network configuration.

  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Kills process with taskkill 6 IoCs
    evasion
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\Solara.exe
    "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2136
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3112
    • C:\Users\Admin\AppData\Local\Temp\Solara.exe
      "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
      2⤵
      • Checks computer location settings
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1796
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:2716
      • C:\Users\Admin\AppData\Local\Temp\Solara.exe
        "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
        3⤵
        • Checks computer location settings
        • Adds Run key to start application
        PID:4020
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:4368
        • C:\Users\Admin\AppData\Local\Temp\Solara.exe
          "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
          4⤵
          • Checks computer location settings
          • Adds Run key to start application
          PID:3512
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            PID:1452
          • C:\Users\Admin\AppData\Local\Temp\Solara.exe
            "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
            5⤵
            • Checks computer location settings
            • Adds Run key to start application
            PID:3828
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
              6⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:1976
            • C:\Users\Admin\AppData\Local\Temp\Solara.exe
              "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
              6⤵
              • Checks computer location settings
              • Adds Run key to start application
              PID:3920
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                7⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                PID:3980
              • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                7⤵
                • Checks computer location settings
                • Adds Run key to start application
                PID:4936
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                  8⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  PID:4608
                • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                  "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                  8⤵
                  • Checks computer location settings
                  • Adds Run key to start application
                  PID:2672
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                    9⤵
                      PID:1628
                    • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                      "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                      9⤵
                      • Checks computer location settings
                      • Adds Run key to start application
                      PID:4000
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                        10⤵
                        • Command and Scripting Interpreter: PowerShell
                        PID:1528
                      • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                        "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                        10⤵
                        • Checks computer location settings
                        • Adds Run key to start application
                        PID:1812
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                          11⤵
                          • Command and Scripting Interpreter: PowerShell
                          PID:1976
                          • C:\Windows\System32\Conhost.exe
                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                            12⤵
                              PID:1784
                          • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                            "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                            11⤵
                            • Checks computer location settings
                            • Adds Run key to start application
                            PID:2852
                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                              12⤵
                              • Command and Scripting Interpreter: PowerShell
                              PID:4148
                            • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                              "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                              12⤵
                              • Checks computer location settings
                              • Adds Run key to start application
                              PID:1360
                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                                13⤵
                                  PID:4048
                                • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                                  "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                                  13⤵
                                  • Checks computer location settings
                                  • Adds Run key to start application
                                  PID:1876
                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                                    14⤵
                                    • Command and Scripting Interpreter: PowerShell
                                    PID:2388
                                  • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                                    "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                                    14⤵
                                    • Checks computer location settings
                                    • Adds Run key to start application
                                    PID:1564
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                                      15⤵
                                        PID:2616
                                      • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                                        "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                                        15⤵
                                        • Checks computer location settings
                                        • Adds Run key to start application
                                        PID:748
                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                                          16⤵
                                          • Command and Scripting Interpreter: PowerShell
                                          PID:2388
                                        • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                                          "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                                          16⤵
                                          • Checks computer location settings
                                          • Adds Run key to start application
                                          PID:1872
                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                                            17⤵
                                            • Command and Scripting Interpreter: PowerShell
                                            PID:220
                                            • C:\Windows\System32\Conhost.exe
                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                              18⤵
                                                PID:2616
                                            • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                                              "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                                              17⤵
                                              • Checks computer location settings
                                              • Adds Run key to start application
                                              PID:2060
                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                                                18⤵
                                                • Command and Scripting Interpreter: PowerShell
                                                PID:2384
                                              • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                                                "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                                                18⤵
                                                • Checks computer location settings
                                                • Adds Run key to start application
                                                PID:4136
                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                                                  19⤵
                                                    PID:1996
                                                  • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                                                    19⤵
                                                    • Checks computer location settings
                                                    • Adds Run key to start application
                                                    PID:4748
                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                                                      20⤵
                                                      • Command and Scripting Interpreter: PowerShell
                                                      PID:3980
                                                    • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                                                      20⤵
                                                      • Checks computer location settings
                                                      • Adds Run key to start application
                                                      PID:4048
                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                                                        21⤵
                                                        • Command and Scripting Interpreter: PowerShell
                                                        PID:3352
                                                        • C:\Windows\System32\Conhost.exe
                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                          22⤵
                                                            PID:2928
                                                        • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                                                          21⤵
                                                          • Checks computer location settings
                                                          • Adds Run key to start application
                                                          PID:252
                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                                                            22⤵
                                                              PID:4188
                                                            • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                                                              22⤵
                                                              • Checks computer location settings
                                                              • Adds Run key to start application
                                                              PID:3004
                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                                                                23⤵
                                                                  PID:4024
                                                                • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                                                                  23⤵
                                                                  • Checks computer location settings
                                                                  • Adds Run key to start application
                                                                  PID:1872
                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                                                                    24⤵
                                                                    • Command and Scripting Interpreter: PowerShell
                                                                    PID:4360
                                                                  • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                                                                    24⤵
                                                                    • Checks computer location settings
                                                                    • Adds Run key to start application
                                                                    PID:1564
                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                                                                      25⤵
                                                                      • Command and Scripting Interpreter: PowerShell
                                                                      PID:3396
                                                                    • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                                                                      25⤵
                                                                      • Checks computer location settings
                                                                      • Adds Run key to start application
                                                                      PID:4704
                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                                                                        26⤵
                                                                          PID:4804
                                                                          • C:\Windows\System32\Conhost.exe
                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                            27⤵
                                                                              PID:1624
                                                                          • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                                                                            26⤵
                                                                            • Checks computer location settings
                                                                            • Adds Run key to start application
                                                                            PID:4688
                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                                                                              27⤵
                                                                              • Command and Scripting Interpreter: PowerShell
                                                                              PID:1144
                                                                            • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                                                                              27⤵
                                                                              • Checks computer location settings
                                                                              • Adds Run key to start application
                                                                              PID:1896
                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                                                                                28⤵
                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                PID:1784
                                                                              • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                                                                                28⤵
                                                                                • Checks computer location settings
                                                                                • Adds Run key to start application
                                                                                PID:3084
                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                                                                                  29⤵
                                                                                    PID:3372
                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                      30⤵
                                                                                        PID:4500
                                                                                    • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                                                                                      "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                                                                                      29⤵
                                                                                      • Checks computer location settings
                                                                                      • Adds Run key to start application
                                                                                      PID:3000
                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                                                                                        30⤵
                                                                                          PID:4956
                                                                                        • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                                                                                          "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                                                                                          30⤵
                                                                                          • Checks computer location settings
                                                                                          • Adds Run key to start application
                                                                                          PID:952
                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                                                                                            31⤵
                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                            PID:3200
                                                                                          • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                                                                                            31⤵
                                                                                            • Checks computer location settings
                                                                                            • Adds Run key to start application
                                                                                            PID:2908
                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                                                                                              32⤵
                                                                                              • Command and Scripting Interpreter: PowerShell
                                                                                              PID:4784
                                                                                            • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                                                                                              "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                                                                                              32⤵
                                                                                              • Checks computer location settings
                                                                                              • Adds Run key to start application
                                                                                              PID:2360
                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                                                                                                33⤵
                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                PID:2948
                                                                                              • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                                                                                                33⤵
                                                                                                • Checks computer location settings
                                                                                                • Adds Run key to start application
                                                                                                PID:4992
                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                                                                                                  34⤵
                                                                                                    PID:4136
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                                                                                                    34⤵
                                                                                                    • Checks computer location settings
                                                                                                    • Adds Run key to start application
                                                                                                    PID:1540
                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                                                                                                      35⤵
                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                      PID:1960
                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                        36⤵
                                                                                                          PID:2112
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                                                                                                        35⤵
                                                                                                          PID:1044
                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                                                                                                            36⤵
                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                            PID:4188
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                                                                                                            36⤵
                                                                                                              PID:3024
                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                                                                                                                37⤵
                                                                                                                  PID:4432
                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                    38⤵
                                                                                                                      PID:940
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                                                                                                                    37⤵
                                                                                                                      PID:1884
                                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                                                                                                                        38⤵
                                                                                                                          PID:328
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                                                                                                                          38⤵
                                                                                                                            PID:2428
                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                                                                                                                              39⤵
                                                                                                                              • Command and Scripting Interpreter: PowerShell
                                                                                                                              PID:4796
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                                                                                                                              39⤵
                                                                                                                                PID:5032
                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                                                                                                                                  40⤵
                                                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                                                  PID:4148
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                                                                                                                                  40⤵
                                                                                                                                    PID:4404
                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                                                                                                                                      41⤵
                                                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                                                      PID:4452
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                                                                                                                                      41⤵
                                                                                                                                        PID:4088
                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                                                                                                                                          42⤵
                                                                                                                                            PID:4780
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                                                                                                                                            42⤵
                                                                                                                                              PID:3220
                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                                                                                                                                                43⤵
                                                                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                                                                PID:2060
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                                                                                                                                                43⤵
                                                                                                                                                  PID:1304
                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                                                                                                                                                    44⤵
                                                                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                                                                    PID:1184
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                                                                                                                                                    44⤵
                                                                                                                                                      PID:188
                                                                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                                                                                                                                                        45⤵
                                                                                                                                                        • Command and Scripting Interpreter: PowerShell
                                                                                                                                                        PID:4544
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                                                                                                                                                        45⤵
                                                                                                                                                          PID:644
                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                                                                                                                                                            46⤵
                                                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                                                            PID:5008
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                                                                                                                                                            46⤵
                                                                                                                                                              PID:444
                                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                                                                                                                                                                47⤵
                                                                                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                PID:4420
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                                                                                                                                                                47⤵
                                                                                                                                                                  PID:2080
                                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                  47⤵
                                                                                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                  PID:4536
                                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                46⤵
                                                                                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                PID:3216
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                46⤵
                                                                                                                                                                  PID:8
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                    47⤵
                                                                                                                                                                      PID:1768
                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "ver"
                                                                                                                                                                        48⤵
                                                                                                                                                                          PID:556
                                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                    45⤵
                                                                                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                    PID:3568
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                    45⤵
                                                                                                                                                                      PID:32
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                        46⤵
                                                                                                                                                                          PID:5076
                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /c "ver"
                                                                                                                                                                            47⤵
                                                                                                                                                                              PID:2716
                                                                                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                        44⤵
                                                                                                                                                                          PID:4936
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                          44⤵
                                                                                                                                                                            PID:4784
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                              45⤵
                                                                                                                                                                                PID:4740
                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "ver"
                                                                                                                                                                                  46⤵
                                                                                                                                                                                    PID:4600
                                                                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                              43⤵
                                                                                                                                                                                PID:3552
                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                  44⤵
                                                                                                                                                                                    PID:3188
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                  43⤵
                                                                                                                                                                                    PID:4564
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                      44⤵
                                                                                                                                                                                        PID:4712
                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "ver"
                                                                                                                                                                                          45⤵
                                                                                                                                                                                            PID:2976
                                                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                                      42⤵
                                                                                                                                                                                        PID:4460
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                        42⤵
                                                                                                                                                                                          PID:252
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                            43⤵
                                                                                                                                                                                              PID:3512
                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "ver"
                                                                                                                                                                                                44⤵
                                                                                                                                                                                                  PID:4992
                                                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                                            41⤵
                                                                                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                            PID:2920
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                            41⤵
                                                                                                                                                                                              PID:4316
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                42⤵
                                                                                                                                                                                                  PID:1972
                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "ver"
                                                                                                                                                                                                    43⤵
                                                                                                                                                                                                      PID:5112
                                                                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                                                40⤵
                                                                                                                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                PID:1628
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                40⤵
                                                                                                                                                                                                  PID:2724
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                    41⤵
                                                                                                                                                                                                      PID:2296
                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "ver"
                                                                                                                                                                                                        42⤵
                                                                                                                                                                                                          PID:5040
                                                                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                                                    39⤵
                                                                                                                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                    PID:2908
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                    39⤵
                                                                                                                                                                                                      PID:3568
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                        40⤵
                                                                                                                                                                                                          PID:1712
                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c "ver"
                                                                                                                                                                                                            41⤵
                                                                                                                                                                                                              PID:224
                                                                                                                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                                                        38⤵
                                                                                                                                                                                                        • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                        PID:1648
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                        38⤵
                                                                                                                                                                                                          PID:348
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                            39⤵
                                                                                                                                                                                                              PID:1984
                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "ver"
                                                                                                                                                                                                                40⤵
                                                                                                                                                                                                                  PID:3948
                                                                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                                                            37⤵
                                                                                                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                            PID:2312
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                            37⤵
                                                                                                                                                                                                              PID:3128
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                38⤵
                                                                                                                                                                                                                  PID:3964
                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "ver"
                                                                                                                                                                                                                    39⤵
                                                                                                                                                                                                                      PID:5048
                                                                                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                                                                36⤵
                                                                                                                                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                PID:2468
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                36⤵
                                                                                                                                                                                                                  PID:2160
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                    37⤵
                                                                                                                                                                                                                      PID:3068
                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "ver"
                                                                                                                                                                                                                        38⤵
                                                                                                                                                                                                                          PID:4792
                                                                                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                                                                    35⤵
                                                                                                                                                                                                                      PID:2932
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                      35⤵
                                                                                                                                                                                                                        PID:1220
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                          36⤵
                                                                                                                                                                                                                            PID:2532
                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c "ver"
                                                                                                                                                                                                                              37⤵
                                                                                                                                                                                                                                PID:1132
                                                                                                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                                                                          34⤵
                                                                                                                                                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                          PID:560
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                          34⤵
                                                                                                                                                                                                                            PID:2228
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                              35⤵
                                                                                                                                                                                                                                PID:188
                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "ver"
                                                                                                                                                                                                                                  36⤵
                                                                                                                                                                                                                                    PID:2880
                                                                                                                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                                                                              33⤵
                                                                                                                                                                                                                                PID:4728
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                33⤵
                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                PID:4056
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                  34⤵
                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                  PID:776
                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "ver"
                                                                                                                                                                                                                                    35⤵
                                                                                                                                                                                                                                      PID:4936
                                                                                                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                                                                                32⤵
                                                                                                                                                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                PID:1124
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                32⤵
                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                PID:1812
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                  33⤵
                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                  PID:2940
                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "ver"
                                                                                                                                                                                                                                    34⤵
                                                                                                                                                                                                                                      PID:4776
                                                                                                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                                                                                31⤵
                                                                                                                                                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                PID:3188
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                31⤵
                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                PID:1880
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                  32⤵
                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                  PID:3656
                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "ver"
                                                                                                                                                                                                                                    33⤵
                                                                                                                                                                                                                                      PID:348
                                                                                                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                                                                                30⤵
                                                                                                                                                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                PID:5116
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                30⤵
                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                PID:3004
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                  31⤵
                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                  PID:444
                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "ver"
                                                                                                                                                                                                                                    32⤵
                                                                                                                                                                                                                                      PID:2968
                                                                                                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                                                                                29⤵
                                                                                                                                                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                PID:3104
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                29⤵
                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                PID:980
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                  30⤵
                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                  PID:1972
                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "ver"
                                                                                                                                                                                                                                    31⤵
                                                                                                                                                                                                                                      PID:3568
                                                                                                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                                                                                28⤵
                                                                                                                                                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                PID:1960
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                28⤵
                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                PID:2288
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                  29⤵
                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                  PID:3596
                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "ver"
                                                                                                                                                                                                                                    30⤵
                                                                                                                                                                                                                                      PID:2988
                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                        31⤵
                                                                                                                                                                                                                                          PID:1872
                                                                                                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                                                                                  27⤵
                                                                                                                                                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                  PID:5116
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                  27⤵
                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                  PID:1796
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                    28⤵
                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                    PID:4664
                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "ver"
                                                                                                                                                                                                                                      29⤵
                                                                                                                                                                                                                                        PID:940
                                                                                                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                                                                                  26⤵
                                                                                                                                                                                                                                    PID:1212
                                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                      27⤵
                                                                                                                                                                                                                                        PID:4368
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                      26⤵
                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                      PID:3948
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                        27⤵
                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                        PID:2112
                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "ver"
                                                                                                                                                                                                                                          28⤵
                                                                                                                                                                                                                                            PID:564
                                                                                                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                                                                                      25⤵
                                                                                                                                                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                      PID:1964
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                      25⤵
                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                      PID:4500
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                        26⤵
                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                        PID:2104
                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "ver"
                                                                                                                                                                                                                                          27⤵
                                                                                                                                                                                                                                            PID:2456
                                                                                                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                                                                                      24⤵
                                                                                                                                                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                      PID:472
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                      24⤵
                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                      PID:2744
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                        25⤵
                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                        PID:1132
                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "ver"
                                                                                                                                                                                                                                          26⤵
                                                                                                                                                                                                                                            PID:4368
                                                                                                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                                                                                      23⤵
                                                                                                                                                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                      PID:4784
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                      23⤵
                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                      PID:2380
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                        24⤵
                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                        PID:3268
                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "ver"
                                                                                                                                                                                                                                          25⤵
                                                                                                                                                                                                                                            PID:1232
                                                                                                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                                                                                      22⤵
                                                                                                                                                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                      PID:748
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                      22⤵
                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                      PID:3120
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                        23⤵
                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                        PID:1512
                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "ver"
                                                                                                                                                                                                                                          24⤵
                                                                                                                                                                                                                                            PID:1352
                                                                                                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                                                                                      21⤵
                                                                                                                                                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                      PID:2428
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                      21⤵
                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                      PID:5072
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                        22⤵
                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                        PID:3900
                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "ver"
                                                                                                                                                                                                                                          23⤵
                                                                                                                                                                                                                                            PID:1624
                                                                                                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                                                                                      20⤵
                                                                                                                                                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                      PID:1048
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                      20⤵
                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                      PID:2748
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                        21⤵
                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                        PID:2796
                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "ver"
                                                                                                                                                                                                                                          22⤵
                                                                                                                                                                                                                                            PID:1548
                                                                                                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                                                                                      19⤵
                                                                                                                                                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                      PID:996
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                      19⤵
                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                      PID:4504
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                        20⤵
                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                        PID:3188
                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "ver"
                                                                                                                                                                                                                                          21⤵
                                                                                                                                                                                                                                            PID:4628
                                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                              22⤵
                                                                                                                                                                                                                                                PID:3248
                                                                                                                                                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                                                                                        18⤵
                                                                                                                                                                                                                                          PID:1976
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                          18⤵
                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                          PID:1980
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                            19⤵
                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                            PID:1012
                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c "ver"
                                                                                                                                                                                                                                              20⤵
                                                                                                                                                                                                                                                PID:3580
                                                                                                                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                                                                                          17⤵
                                                                                                                                                                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                          PID:4784
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                          17⤵
                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                          PID:2456
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                            18⤵
                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                            PID:2628
                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c "ver"
                                                                                                                                                                                                                                              19⤵
                                                                                                                                                                                                                                                PID:1896
                                                                                                                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                                                                                          16⤵
                                                                                                                                                                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                          PID:4612
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                          16⤵
                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                          PID:808
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                            17⤵
                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                            PID:2380
                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c "ver"
                                                                                                                                                                                                                                              18⤵
                                                                                                                                                                                                                                                PID:4412
                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                  19⤵
                                                                                                                                                                                                                                                    PID:2852
                                                                                                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                                                                                            15⤵
                                                                                                                                                                                                                                              PID:4316
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                              15⤵
                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                              PID:2552
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                                16⤵
                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                PID:4432
                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "ver"
                                                                                                                                                                                                                                                  17⤵
                                                                                                                                                                                                                                                    PID:4784
                                                                                                                                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                                                                                              14⤵
                                                                                                                                                                                                                                              • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                              PID:1472
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                              14⤵
                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                              PID:3504
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                                15⤵
                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                PID:4680
                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "ver"
                                                                                                                                                                                                                                                  16⤵
                                                                                                                                                                                                                                                    PID:2928
                                                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                      17⤵
                                                                                                                                                                                                                                                        PID:1628
                                                                                                                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                                                                                                13⤵
                                                                                                                                                                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                PID:3068
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                                13⤵
                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                PID:4404
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                                  14⤵
                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                  PID:952
                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "ver"
                                                                                                                                                                                                                                                    15⤵
                                                                                                                                                                                                                                                      PID:3248
                                                                                                                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                                                                                                12⤵
                                                                                                                                                                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                PID:1436
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                                12⤵
                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                PID:4788
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                                  13⤵
                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                  PID:2712
                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "ver"
                                                                                                                                                                                                                                                    14⤵
                                                                                                                                                                                                                                                      PID:4088
                                                                                                                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                                                                                                11⤵
                                                                                                                                                                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                PID:4420
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                                11⤵
                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                PID:4448
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                                  12⤵
                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                  PID:4404
                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "ver"
                                                                                                                                                                                                                                                    13⤵
                                                                                                                                                                                                                                                      PID:1996
                                                                                                                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                                                                                                10⤵
                                                                                                                                                                                                                                                  PID:3920
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                                  10⤵
                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                  PID:2396
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                                    11⤵
                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                    PID:4620
                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "ver"
                                                                                                                                                                                                                                                      12⤵
                                                                                                                                                                                                                                                        PID:3188
                                                                                                                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                                                                                                  9⤵
                                                                                                                                                                                                                                                    PID:1784
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                                    9⤵
                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                    PID:1480
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                                      10⤵
                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                      PID:2212
                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "ver"
                                                                                                                                                                                                                                                        11⤵
                                                                                                                                                                                                                                                          PID:2036
                                                                                                                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                    PID:1652
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                    PID:4152
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                                      9⤵
                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                      PID:3112
                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "ver"
                                                                                                                                                                                                                                                        10⤵
                                                                                                                                                                                                                                                          PID:3064
                                                                                                                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                    PID:4236
                                                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                                                                        PID:1852
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                      PID:776
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        PID:3216
                                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "ver"
                                                                                                                                                                                                                                                          9⤵
                                                                                                                                                                                                                                                            PID:2032
                                                                                                                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                      PID:3804
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                      PID:4664
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        PID:2584
                                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "ver"
                                                                                                                                                                                                                                                          8⤵
                                                                                                                                                                                                                                                            PID:3504
                                                                                                                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                      PID:4780
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                      PID:4708
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        PID:4852
                                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "ver"
                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                            PID:3984
                                                                                                                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                      PID:4720
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                      PID:2972
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                                                                                                                        PID:3868
                                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "ver"
                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                            PID:1456
                                                                                                                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                      PID:4708
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                      PID:4492
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                                                                                                                        PID:1984
                                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "ver"
                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                            PID:3524
                                                                                                                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                      PID:1244
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                      PID:3456
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                        PID:1504
                                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "ver"
                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                            PID:3076
                                                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                PID:3608
                                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                              PID:4660
                                                                                                                                                                                                                                                              • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                                                wmic path win32_VideoController get name
                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                • Detects videocard installed
                                                                                                                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                PID:1576
                                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c "wmic computersystem get Manufacturer"
                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                              PID:3684
                                                                                                                                                                                                                                                              • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                                                wmic computersystem get Manufacturer
                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                PID:860
                                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c "gdb --version"
                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                PID:3824
                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "tasklist"
                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                PID:1212
                                                                                                                                                                                                                                                                • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                                                                                  tasklist
                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                  • Enumerates processes with tasklist
                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                  PID:2468
                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "wmic path Win32_ComputerSystem get Manufacturer"
                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                PID:4852
                                                                                                                                                                                                                                                                • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                                                  wmic path Win32_ComputerSystem get Manufacturer
                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                  PID:2848
                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                PID:1728
                                                                                                                                                                                                                                                                • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                                                  wmic csproduct get uuid
                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                  PID:980
                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "tasklist"
                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                PID:3972
                                                                                                                                                                                                                                                                • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                                                                                  tasklist
                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                  • Enumerates processes with tasklist
                                                                                                                                                                                                                                                                  PID:3540
                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe""
                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                PID:2928
                                                                                                                                                                                                                                                                • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                                                                  attrib +h +s "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe"
                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                  • Views/modifies file attributes
                                                                                                                                                                                                                                                                  PID:2792
                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "tasklist"
                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                PID:4676
                                                                                                                                                                                                                                                                • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                                                                                  tasklist
                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                  • Enumerates processes with tasklist
                                                                                                                                                                                                                                                                  PID:4088
                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "taskkill /F /PID 2868"
                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                PID:3608
                                                                                                                                                                                                                                                                • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                                                                                                  taskkill /F /PID 2868
                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                  PID:4524
                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "taskkill /F /PID 1564"
                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                PID:3824
                                                                                                                                                                                                                                                                • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                                                                                                  taskkill /F /PID 1564
                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                  PID:812
                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "taskkill /F /PID 3200"
                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                PID:644
                                                                                                                                                                                                                                                                • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                                                                                                  taskkill /F /PID 3200
                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                  PID:852
                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "taskkill /F /PID 376"
                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                PID:2888
                                                                                                                                                                                                                                                                • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                                                                                                  taskkill /F /PID 376
                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                  PID:4564
                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "taskkill /F /PID 3080"
                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                  PID:2468
                                                                                                                                                                                                                                                                  • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                                                                                                    taskkill /F /PID 3080
                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                    • Kills process with taskkill
                                                                                                                                                                                                                                                                    PID:808
                                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "taskkill /F /PID 1884"
                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                    PID:1852
                                                                                                                                                                                                                                                                    • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                                                                                                      taskkill /F /PID 1884
                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                      • Kills process with taskkill
                                                                                                                                                                                                                                                                      PID:2792
                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                      PID:4720
                                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                        cmd.exe /c chcp
                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                          PID:4940
                                                                                                                                                                                                                                                                          • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                            chcp
                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                              PID:3828
                                                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                            PID:3004
                                                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                              cmd.exe /c chcp
                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                PID:3216
                                                                                                                                                                                                                                                                                • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                  chcp
                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                    PID:4664
                                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                  PID:4312
                                                                                                                                                                                                                                                                                  • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                                                                                                    tasklist /FO LIST
                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                    • Enumerates processes with tasklist
                                                                                                                                                                                                                                                                                    PID:2900
                                                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"
                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                  • Clipboard Data
                                                                                                                                                                                                                                                                                  PID:3600
                                                                                                                                                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                    powershell.exe Get-Clipboard
                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                    • Clipboard Data
                                                                                                                                                                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                    PID:540
                                                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                  • System Network Configuration Discovery: Wi-Fi Discovery
                                                                                                                                                                                                                                                                                  PID:2536
                                                                                                                                                                                                                                                                                  • C:\Windows\system32\netsh.exe
                                                                                                                                                                                                                                                                                    netsh wlan show profiles
                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                    • Event Triggered Execution: Netsh Helper DLL
                                                                                                                                                                                                                                                                                    • System Network Configuration Discovery: Wi-Fi Discovery
                                                                                                                                                                                                                                                                                    PID:4080
                                                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"
                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                  • Network Service Discovery
                                                                                                                                                                                                                                                                                  PID:4472
                                                                                                                                                                                                                                                                                  • C:\Windows\system32\systeminfo.exe
                                                                                                                                                                                                                                                                                    systeminfo
                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                    • Gathers system information
                                                                                                                                                                                                                                                                                    PID:1944
                                                                                                                                                                                                                                                                                  • C:\Windows\system32\HOSTNAME.EXE
                                                                                                                                                                                                                                                                                    hostname
                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                      PID:2928
                                                                                                                                                                                                                                                                                    • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                                                                      wmic logicaldisk get caption,description,providername
                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                      • Collects information from the system
                                                                                                                                                                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                      PID:952
                                                                                                                                                                                                                                                                                    • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                                                                      net user
                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                        PID:3804
                                                                                                                                                                                                                                                                                        • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                                                          C:\Windows\system32\net1 user
                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                            PID:920
                                                                                                                                                                                                                                                                                        • C:\Windows\system32\query.exe
                                                                                                                                                                                                                                                                                          query user
                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                            PID:2388
                                                                                                                                                                                                                                                                                            • C:\Windows\system32\quser.exe
                                                                                                                                                                                                                                                                                              "C:\Windows\system32\quser.exe"
                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                PID:2368
                                                                                                                                                                                                                                                                                            • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                                                                              net localgroup
                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                PID:2968
                                                                                                                                                                                                                                                                                                • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\system32\net1 localgroup
                                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                                    PID:4708
                                                                                                                                                                                                                                                                                                • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                                                                                  net localgroup administrators
                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                    PID:1528
                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\system32\net1 localgroup administrators
                                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                                        PID:1892
                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                                                                                      net user guest
                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                        PID:1948
                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\system32\net1 user guest
                                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                                            PID:4996
                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                                                                                          net user administrator
                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                            PID:2084
                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                                                                              C:\Windows\system32\net1 user administrator
                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                                PID:5032
                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                                                                                              wmic startup get caption,command
                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                              PID:1628
                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                                                                                                                              tasklist /svc
                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                              • Enumerates processes with tasklist
                                                                                                                                                                                                                                                                                                              PID:3972
                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\ipconfig.exe
                                                                                                                                                                                                                                                                                                              ipconfig /all
                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                              • Gathers network information
                                                                                                                                                                                                                                                                                                              PID:3120
                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\ROUTE.EXE
                                                                                                                                                                                                                                                                                                              route print
                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                PID:5020
                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\ARP.EXE
                                                                                                                                                                                                                                                                                                                arp -a
                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                • Network Service Discovery
                                                                                                                                                                                                                                                                                                                PID:2388
                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\NETSTAT.EXE
                                                                                                                                                                                                                                                                                                                netstat -ano
                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                • System Network Connections Discovery
                                                                                                                                                                                                                                                                                                                • Gathers network information
                                                                                                                                                                                                                                                                                                                PID:1360
                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                                                                                                                sc query type= service state= all
                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                • Launches sc.exe
                                                                                                                                                                                                                                                                                                                PID:1164
                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\netsh.exe
                                                                                                                                                                                                                                                                                                                netsh firewall show state
                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                • Modifies Windows Firewall
                                                                                                                                                                                                                                                                                                                • Event Triggered Execution: Netsh Helper DLL
                                                                                                                                                                                                                                                                                                                PID:1528
                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\netsh.exe
                                                                                                                                                                                                                                                                                                                netsh firewall show config
                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                • Modifies Windows Firewall
                                                                                                                                                                                                                                                                                                                • Event Triggered Execution: Netsh Helper DLL
                                                                                                                                                                                                                                                                                                                PID:4740
                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                PID:1532
                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                                                                                                  wmic csproduct get uuid
                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                  PID:3092
                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                  PID:636
                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                                                                                                    wmic csproduct get uuid
                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                    PID:3460
                                                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --string-annotations=is-enterprise-managed=no --field-trial-handle=4036,i,17437436182398955805,1059754208013914332,262144 --variations-seed-version --mojo-platform-channel-handle=4040 /prefetch:8
                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                              PID:1884

                                                                                                                                                                                                                                                                                                            Network

                                                                                                                                                                                                                                                                                                            MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                                                                            Reconnaissance

                                                                                                                                                                                                                                                                                                            Resource Development

                                                                                                                                                                                                                                                                                                            Initial Access

                                                                                                                                                                                                                                                                                                            Execution

                                                                                                                                                                                                                                                                                                            Command and Scripting Interpreter

                                                                                                                                                                                                                                                                                                            2
                                                                                                                                                                                                                                                                                                            T1059

                                                                                                                                                                                                                                                                                                            PowerShell

                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            T1059.001

                                                                                                                                                                                                                                                                                                            Persistence

                                                                                                                                                                                                                                                                                                            Account Manipulation

                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            T1098

                                                                                                                                                                                                                                                                                                            Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            T1547

                                                                                                                                                                                                                                                                                                            Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            T1547.001

                                                                                                                                                                                                                                                                                                            Create or Modify System Process

                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            T1543

                                                                                                                                                                                                                                                                                                            Windows Service

                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            T1543.003

                                                                                                                                                                                                                                                                                                            Event Triggered Execution

                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            T1546

                                                                                                                                                                                                                                                                                                            Netsh Helper DLL

                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            T1546.007

                                                                                                                                                                                                                                                                                                            Privilege Escalation

                                                                                                                                                                                                                                                                                                            Account Manipulation

                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            T1098

                                                                                                                                                                                                                                                                                                            Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            T1547

                                                                                                                                                                                                                                                                                                            Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            T1547.001

                                                                                                                                                                                                                                                                                                            Create or Modify System Process

                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            T1543

                                                                                                                                                                                                                                                                                                            Windows Service

                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            T1543.003

                                                                                                                                                                                                                                                                                                            Event Triggered Execution

                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            T1546

                                                                                                                                                                                                                                                                                                            Netsh Helper DLL

                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            T1546.007

                                                                                                                                                                                                                                                                                                            Defense Evasion

                                                                                                                                                                                                                                                                                                            Hide Artifacts

                                                                                                                                                                                                                                                                                                            2
                                                                                                                                                                                                                                                                                                            T1564

                                                                                                                                                                                                                                                                                                            Hidden Files and Directories

                                                                                                                                                                                                                                                                                                            2
                                                                                                                                                                                                                                                                                                            T1564.001

                                                                                                                                                                                                                                                                                                            Impair Defenses

                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            T1562

                                                                                                                                                                                                                                                                                                            Disable or Modify System Firewall

                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            T1562.004

                                                                                                                                                                                                                                                                                                            Modify Registry

                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            T1112

                                                                                                                                                                                                                                                                                                            Credential Access

                                                                                                                                                                                                                                                                                                            Credentials from Password Stores

                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            T1555

                                                                                                                                                                                                                                                                                                            Credentials from Web Browsers

                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            T1555.003

                                                                                                                                                                                                                                                                                                            Unsecured Credentials

                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            T1552

                                                                                                                                                                                                                                                                                                            Credentials In Files

                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            T1552.001

                                                                                                                                                                                                                                                                                                            Discovery

                                                                                                                                                                                                                                                                                                            Browser Information Discovery

                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            T1217

                                                                                                                                                                                                                                                                                                            Network Service Discovery

                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            T1046

                                                                                                                                                                                                                                                                                                            Permission Groups Discovery

                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            T1069

                                                                                                                                                                                                                                                                                                            Local Groups

                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            T1069.001

                                                                                                                                                                                                                                                                                                            Process Discovery

                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            T1057

                                                                                                                                                                                                                                                                                                            Query Registry

                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            T1012

                                                                                                                                                                                                                                                                                                            System Information Discovery

                                                                                                                                                                                                                                                                                                            5
                                                                                                                                                                                                                                                                                                            T1082

                                                                                                                                                                                                                                                                                                            System Network Configuration Discovery

                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            T1016

                                                                                                                                                                                                                                                                                                            Wi-Fi Discovery

                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            T1016.002

                                                                                                                                                                                                                                                                                                            System Network Connections Discovery

                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            T1049

                                                                                                                                                                                                                                                                                                            Lateral Movement

                                                                                                                                                                                                                                                                                                            Collection

                                                                                                                                                                                                                                                                                                            Clipboard Data

                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            T1115

                                                                                                                                                                                                                                                                                                            Data from Local System

                                                                                                                                                                                                                                                                                                            2
                                                                                                                                                                                                                                                                                                            T1005

                                                                                                                                                                                                                                                                                                            Command and Control

                                                                                                                                                                                                                                                                                                            Exfiltration

                                                                                                                                                                                                                                                                                                            Impact

                                                                                                                                                                                                                                                                                                            Replay Monitor

                                                                                                                                                                                                                                                                                                            Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                            Downloads

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              3KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              3eb3833f769dd890afc295b977eab4b4

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              e857649b037939602c72ad003e5d3698695f436f

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              c485a6e2fd17c342fca60060f47d6a5655a65a412e35e001bb5bf88d96e6e485

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              c24bbc8f278478d43756807b8c584d4e3fb2289db468bc92986a489f74a8da386a667a758360a397e77e018e363be8912ac260072fa3e31117ad0599ac749e72

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              1KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              60b3262c3163ee3d466199160b9ed07d

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              994ece4ea4e61de0be2fdd580f87e3415f9e1ff6

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              e3b30f16d41f94cba2b8a75f35c91ae7418465abfbfe5477ec0551d1952b2fdb

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              081d2015cb94477eb0fbc38f44b6d9b4a3204fb3ad0b7d0e146a88ab4ab9a0d475207f1adae03f4a81ccc5beb7568dc8be1249f69e32fe56efd9ee2f6ee3b1af

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              9.5MB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              0615d49be12c174704a3daad945f7b56

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              90d67801dcff362ce2c2accafd5010c7f79567d6

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              573a7f2fa701a7630318119d9e6d916cb8a0acd87a0a2797b7197e9ae85c0071

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              40d702b8fd2993aeeb09755e760d3611d76f927ae6831ab7066386d3a133257e06330ddff2d28406b77c1d9e502e79a7a72b8984ce0d795948da07dd03b9bea9

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI29722\attrs-24.3.0.dist-info\INSTALLER
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              4B

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              365c9bfeb7d89244f2ce01c1de44cb85

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              d7a03141d5d6b1e88b6b59ef08b6681df212c599

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI34562\VCRUNTIME140.dll
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              106KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              870fea4e961e2fbd00110d3783e529be

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              a948e65c6f73d7da4ffde4e8533c098a00cc7311

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              76fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              0b636a3cdefa343eb4cb228b391bb657b5b4c20df62889cd1be44c7bee94ffad6ec82dc4db79949edef576bff57867e0d084e0a597bf7bf5c8e4ed1268477e88

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI34562\_asyncio.pyd
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              34KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              7d4f9a2b793e021f7e37b8448751ed4e

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              0ea07b5024501aad5008655cfeae6d96b5da957a

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              2293c1b6b0b901832a57a1c4dcb1265c9e92d21177195712c30632a7b63227d4

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              af75452279c308c61c3e222a031a8201e47e8fe44c4e92cb7dab03d56c7e7e3e2a2c589f650c50e0b29e2df175d6f2ff50c8e5e589d17a124bf0a2e0d7886c26

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI34562\_bz2.pyd
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              46KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              6250a28b9d0bfefc1254bd78ece7ae9f

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              4b07c8e18d23c8ae9d92d7b8d39ae20bc447aecd

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              7d43f7105aa4f856239235c67f61044493ee6f95ddf04533189bf5ea98073f0b

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              6d0aa5c3f8f5b268b94341dfdd5afbe48f91f9aac143bf59f7f5e8ba6f54205b85ec527c53498ed8860fdff6a8d08e48ec4e1652eeab2d3c89aaaf3a14fcaaa7

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI34562\_cffi_backend.cp310-win_amd64.pyd
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              71KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              7727212e7bdbf63b1a39fb7faad24265

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              a8fdec19d6690081b2bf55247e8e17657a68ac97

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              b0116303e1e903d6eb02a69d05879f38af1640813f4b110cb733ffff6e4e985c

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              2b1a27642118dd228791d0d8ba307aa39ab2d9c7d3799cff9f3c0744fe270eeaefe5545a4fda6e74e86fee747e45bf5f6c9ac799950c2b483a16eb3ce85d816a

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI34562\_ctypes.pyd
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              56KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              4b90108fabdd64577a84313c765a2946

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              245f4628683a3e18bb6f0d1c88aa26fb959ed258

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              e1b634628839a45ab08913463e07b6b6b7fd502396d768f43b21da2875b506a1

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              91fa069d7cf61c57faad6355f6fd46d702576c4342460dadcedfdcbc07cd9d84486734f0561fa5e1e01668b384c3c07dd779b332f77d0bb6fbdbb8c0cb5091bc

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI34562\_decimal.pyd
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              103KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              20985dc78dbd1992382354af5ca28988

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              385a3e7a7654e5e4c686399f3a72b235e941e311

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              f3620cac68595b8a8495ab044f19a1c89012f50d2fe571b7a1721485f7ff2e43

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              61b8ecd2d12b3f785773b98d4bf4af0eb6eb2c61fbea6effb77ec24b2127e888d0ea5fdd8cc298484e0f770d70c87907048fc382faace8e0ca6b49ab106c89f8

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI34562\_hashlib.pyd
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              33KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              3b5530f497ff7c127383d0029e680c35

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              fb5dc554bb9ff49622184cc16883a7567115c7ca

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              5971fcc9758b7f4a12cde2190a323f35a34ab7f97bd8c39cc8f3335223102573

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              12ced7ddb0352f8eca3c3cb7c7c2faaf08e617b2dd278d20008051fb6b564b17c3e9ecfa8b0ffe7674154ad533dfbbf1e802accd5e1aef12ece01368da06e85a

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI34562\_lzma.pyd
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              84KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              8edbeeccb6f3dbb09389d99d45db5542

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              f7e7af2851a5bf22de79a24fe594b5c0435fca8a

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              90701973be6b23703e495f6a145bae251a7bb066d3c5f398ec42694fd06a069f

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              2a8bf60f2280b9a947578bd7fd49c3ace8e010a3d4b38e370edb511ea0e125df688bbac369d6a3cec9d285a1fa2ad2dac18a0ef30fda46e49a9440418581e501

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI34562\_multiprocessing.pyd
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              25KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              4fbc5fd5da9da74c04fe0374387b34d3

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              1e9c98db0486f98fb7d8eb9fa57a949494b649b5

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              b2347790c87052623710382d3178887f68a79618d6da5174909f46b169236950

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              ce87d4512c2ab7c1ad7986e8e1fe790615ae39c7667d234dfc09026ee7e1518b3bfbf7974612811db0c3e5654b35b54e118e23e624bebe027a51d2c8f2a4652a

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI34562\_overlapped.pyd
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              30KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              5c1441f6ee11632183a83dac2d22853b

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              eef732ff4bab9ea5c8fffb6a93c47cfc8e64dae2

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              104e0b0e0e9fec9eb6438683296feeba298d5f23b02d2080577fc87ffec67acf

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              e41d3433754a8a3d2c572bb7f3902c0d37cba2e6f3307f0e6dfed316a22b11ef7e52a73c30085fa89fcff603e4b76858abe761217c320e38fa2eb95d1777b595

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI34562\_queue.pyd
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              24KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              5c4c43763fb1a796134aa5734905c891

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              44a5e1ae4806406a239129d77888bd87d291a410

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              4edc80e7d331ba0e9338431d407157181190f995821d1cd24f7a7aa2422ece0c

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              07bec7e4a85e76cfab2c21776b50ee2bd0454835fcb43b573dee757eca24cbeb4530784bae07de3be90820cee6d72023d9ded395d4f1a4931971db247dc1a71e

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI34562\_socket.pyd
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              41KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              53e72716073038c1dd1db65bfdb1254c

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              7bf220a02a3b51aa51300b3a9ea7fa48358ca161

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              e1fb6927ba2ed014d0ac750af0ee0bb3d49487dd6920848937259606e1e92e1d

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              c10d91b6ec82402b0eb05dc31a4703c999f4988e88204b695e009fae5fdcc61e8a6dc4d2879ecf2babc030224048afd2f256b9e7f5c5b6f28762047813be0941

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI34562\_sqlite3.pyd
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              48KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              e7d68df8f65fbb0298a45519e2336f32

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              ad3c84ad7eb75a61f287b1ba9fd2801567e39b6d

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              2473ebaf52723c3751a12117ebbe974e50ecdaeb40b282a12ba4e6aa98492e79

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              626204685e9b95310aba51be4a8abaf3b6e152fa35902f64f837303fc4011a4518ee393047ceb45bf377e9d965d169c92bfbb6673475150e159c59b7857ba03e

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI34562\_ssl.pyd
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              60KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              7e9d95ac47a2284706318656b4f711d3

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              f085104709201c6e64635aeacf1da51599054e55

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              38dcb3d0f217785b39c03d4c949dd1e04b70e9eade8a4ad83f026390684059c9

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              294a5148d8fcddabd177b776617da7720d9876ac2a1cdf8dd7b9489f0f719600a634346cdfa07da66588de885b0a64d8cccde4d47edbf6305bd2af44ee209118

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI34562\_uuid.pyd
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              21KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              59cfd9669367517b384922b2485cb6a7

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              1bd44298543204d61d4efd2cd3980ad01071360d

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              e02bfad84786560b624efd56df55c88a4ffbd6c7cfc728bf68b6401aa10f849f

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              d0dd041d8493c7c19db01ea8477981148726796ce2ab58d3193064123319bd5b68fd57871d1db0aaa08d07f78ab96a3d343051c33ffd406e96b921248ea32665

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI34562\aiohttp\_http_parser.cp310-win_amd64.pyd
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              81KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              23df1d1a4bfd29c6c0f89d1a42bbecbb

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              b8e5686724223bd5e8ed0b7a3517cdc3005be66a

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              10f7967a3c574caea10fd5a94c9b6eba405ed6afec402969424c143566593adc

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              75a455a9eb96bd52f0d795188a1120ee14d36944c331d97b4c3da837238bd2928cff29df27c0f17093022d976c0c2e54189babd94c6dc927ac325216c340481a

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI34562\aiohttp\_http_writer.cp310-win_amd64.pyd
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              24KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              b0e8cbf64f3728eee12e6e0756e67c95

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              71bc5ae8847dac5d0737e6321833a37da655d538

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              7a931c3108173c4d8cc4ed7304414fcd3ba67ceff81f84506dcdda8979f5f33b

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              622126f5a1fc5e275680bb64648a8cac6a5eaf3e7d6a262f0002afc26cec6d9c3addbba257626ac54189b7f85e5abdfc3809954ce0437046fc64b643a4e8cb5a

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI34562\aiohttp\_websocket\mask.cp310-win_amd64.pyd
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              19KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              2b5d378afb9aeb031ed1a84f5c216291

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              7955e2ec7e7ffa13e58af098d37c480c8f23ccad

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              1d44b957609599fdf3115bb47bd668f560b63d4d84c74c1f7bf1f3dc05246d6a

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              9102a95c57024afddb67b6500ce1606a2bf5923aa66f67e21fec23c1efb1c9a0cd77c55417b25c7cdbcda119cd817ea4219a1fe321a2f9300f8bffa99d8b0a31

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI34562\aiohttp\_websocket\reader_c.cp310-win_amd64.pyd
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              61KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              2cb730463ee9a2360b568bb54ff283b1

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              e63b5d62d281f153ab2c3487f4423bec259e1bd5

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              17b026c18dc25b2f8842da41484e39c8e92bd3ff9fe0f6d03f9fdc389991e7ae

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              a7891ba2619cc6910c47ffac153ba31a3b17f67f08654f7a1fed380b1f4951673573f5e5a59e45e4edc432b135dbb57bb82c3b4cbdfc265d0daa6fca587ab732

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI34562\base_library.zip
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              859KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              9b62388394601020bd24fa9e7b4e9e0a

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              06023daf857014770ff38d4ebbd600ba03109f28

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              a6993db44fde43c8fdbf3512db50060812924c95f6f60aeb80913380a0b4f3e1

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              ac1bfebb36d844a0c5909b34fc1100ff2d1f88a0b71a75aa27b4d2b281a90dcb05259b874e4fdb300572a0c029db96e507b5caefdaf03cc32050dc2b728c654b

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI34562\libcrypto-1_1.dll
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              1.1MB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              86cfc84f8407ab1be6cc64a9702882ef

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              86f3c502ed64df2a5e10b085103c2ffc9e3a4130

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              11b89cc5531b2a6b89fbbb406ebe8fb01f0bf789e672131b0354e10f9e091307

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              b33f59497127cb1b4c1781693380576187c562563a9e367ce8abc14c97c51053a28af559cdd8bd66181012083e562c8a8771e3d46adeba269a848153a8e9173c

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI34562\libffi-7.dll
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              23KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              d50ebf567149ead9d88933561cb87d09

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              171df40e4187ebbfdf9aa1d76a33f769fb8a35ed

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              6aa8e12ce7c8ad52dd2e3fabeb38a726447849669c084ea63d8e322a193033af

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              7bcc9d6d3a097333e1e4b2b23c81ea1b5db7dbdc5d9d62ebaffb0fdfb6cfe86161520ac14dc835d1939be22b9f342531f48da70f765a60b8e2c3d7b9983021de

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI34562\libssl-1_1.dll
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              203KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              6cd33578bc5629930329ca3303f0fae1

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              f2f8e3248a72f98d27f0cfa0010e32175a18487f

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              4150ee603ad2da7a6cb6a895cb5bd928e3a99af7e73c604de1fc224e0809fdb0

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              c236a6ccc8577c85509d378c1ef014621cab6f6f4aa26796ff32d8eec8e98ded2e55d358a7d236594f7a48646dc2a6bf25b42a37aed549440d52873ebca4713e

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI34562\multidict\_multidict.cp310-win_amd64.pyd
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              20KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              7f691747ce66d3ed05a7c2c53220c8b5

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              1d3f247042030cf8cf7c859002941beba5d15776

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              7d6472a0d7f1a0740c7fc0d0d0ea6f7c6e7cb2b11b8c623c46a6fae1adb4e228

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              b01f0e91039fc5b2782caaa0b3d56d5d1fe9e94424cc536cde9eca73a76747736060042e345af9edc5ef5bf5c154705d2c2dddf35536f305306be25a955a9f06

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI34562\propcache\_helpers_c.cp310-win_amd64.pyd
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              31KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              9fe92acae9522cd0044146e1b57c23fa

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              ec8875039a387bb4ac302cd533b2fe27dbe75b43

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              622077d084db60b50c43a1923d60c02f1900fffa3b5a11dfd34328e6fd341362

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              cdf5dae191f9b6c75d5698d49d1a55a00695ac896a0823357ea7bf3332683231cb10b1544ec12fab5cf5a15117a92af18e1266f29ed3d3ccbcb56ff46a421e88

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI34562\pyexpat.pyd
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              86KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              46331749084f98bcfe8631d74c5e038f

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              5e5510f7a4d03f10d979e0d6a0d2a6f0e53ca347

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              21cc4b9ccd69d08d7c1068b1f004ae9454f7ea0a322801860faf0e6f4a24a3df

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              edd39ce2d927fb6700a86db07f4f56cab897ef91a320f3e5ecb542ea1be6888dd27a08008e5fa1df3765b0c82d1046a23c8d59e76d11f4e6449d4d6826879589

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI34562\python3.dll
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              63KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              c17b7a4b853827f538576f4c3521c653

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              6115047d02fbbad4ff32afb4ebd439f5d529485a

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              d21e60f3dfbf2bab0cc8a06656721fa3347f026df10297674fc635ebf9559a68

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              8e08e702d69df6840781d174c4565e14a28022b40f650fda88d60172be2d4ffd96a3e9426d20718c54072ca0da27e0455cc0394c098b75e062a27559234a3df7

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI34562\python310.dll
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              1.4MB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              fc7bd515b12e537a39dc93a09b3eaad6

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              96f5d4b0967372553cb106539c5566bc184f6167

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              461e008b7cdf034f99a566671b87849772873a175aefec6ed00732976f5c4164

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              a8433d5b403f898e4eeebd72fce08ebad066ca60aeb0b70e2ae78377babc2acbbae2ac91ab20f813cce4b1dc58c2ad6b3868f18cc8ac0fe7be2bff020eb73122

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI34562\select.pyd
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              24KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              3797a47a60b606e25348c67043874fe8

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              63a33fedffd52190236a6acd0fc5d9d491e3ac45

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              312e9b01d1632840983e8533d1685a64fb87e4538f724a7a59a71b1ba148bbac

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              3eb7599825b7b21aaab05e420dd16d4a8eaa21652d232f6e4ede213a232b701401556e44df73cfa20ae855d1adc28304b52d42367b74ebd8e96c2e3d9a9b93e2

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI34562\sqlite3.dll
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              608KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              6a3a34c9c67efd6c17d44292e8db8fad

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              339b1e514d60d8370eaec1e2f2b71cead999f970

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              7b0e840165d65f0f5285476467e4c154c4d936613966b84948110a4614b9cad9

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              6f2a1b670d28762745f0d3b961a331cbbb0dec244f8798734b911b3a3bc9519c73a3b26f1e1117725f6f1e880e57cadb562a1450659bca1aae353f6b9575d7f5

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI34562\unicodedata.pyd
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              287KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              fed35db31377d515d198e5e446498be2

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              62e388d17e17208ea0e881ccd96c75b7b1fbc5f7

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              af3cdc9a2a1d923be67244429867a3c5c70835249e3573a03b98d08d148fe24b

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              0985528cb0289086ec895e21a8947e04f732d5660460f2e7fa8668bd441c891438781c808bcea9294f348720e3752c10ea65363371f7e75ea48600d016bab72a

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI34562\yarl\_quoting_c.cp310-win_amd64.pyd
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              41KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              8640834733897205d9193e1b21084135

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              e452ae2dbabcc8691233428dd1da5d23961b047d

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              bd209ab04ba8a3a40546832380547a460b1257f4fb4b4012f6fc48f9c36cc476

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              365805a31ed3ef7648fa2fac49fecc0646dd5dfcad8468918623d962db6aab08339f510edccdaf1340f8bfc06a4628c070de947cdec55cfabdc3563af2de43e7

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI46642\attrs-24.3.0.dist-info\METADATA
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              11KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              0e682e7854fe836cad441326ab36d36d

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              3efad7961f8f2dfb0a22a1eeabd3a92b9da0ab23

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              7fd8611027805324bb89ec073d1b8c2c3cb5b6927abf2cbc47f4ca5270a6880f

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              54fd3b0c98dce7c11691d08ca22c9c8a74cd838d03723dda3fbac326efc2550edb892f9d45aa3956c9c5c35b8c20fe096f6a002dee07150b437a1e7e76ac175a

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI46642\attrs-24.3.0.dist-info\RECORD
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              3KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              72c9f466183f7eae813f25ed47198941

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              7498fae0d90f7f64d6c954849225e82c8f1bac92

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              a237de627ee31b429fed81bdff4fa5b5b22bc979a2580e1205acaedc78761143

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              6ed2a1293fa6e27ca3bdaa95af38e3b2299d1d77b7e0fb2d67552cd8f3acaee5be94d4f3f562e6bc42e6f6c7fc9d302c7bd5b14a1243ef86979e077242173c35

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI46642\attrs-24.3.0.dist-info\WHEEL
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              87B

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              e2fcb0ad9ea59332c808928b4b439e7a

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              07311208d4849f821e8af25a89a9985c4503fbd8

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              aad0b0a12256807936d52d4a6f88a1773236ae527564a688bab4e3fe780e8724

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              d4cb3ca64d69678959c4f59b4d1cb992e8e2e046a6acb92341fd30b8ce862bd81a48cbfa09ec9ae2e735ffec5c12d246d1593a859615adee10984635a9ba8af9

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI46642\attrs-24.3.0.dist-info\licenses\LICENSE
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              1KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              5e55731824cf9205cfabeab9a0600887

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              243e9dd038d3d68c67d42c0c4ba80622c2a56246

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              882115c95dfc2af1eeb6714f8ec6d5cbcabf667caff8729f42420da63f714e9f

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              21b242bf6dcbafa16336d77a40e69685d7e64a43cc30e13e484c72a93cd4496a7276e18137dc601b6a8c3c193cb775db89853ecc6d6eb2956deee36826d5ebfe

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI46642\cryptography-44.0.0.dist-info\METADATA
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              5KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              526d9ac9d8150602ec9ed8b9f4de7102

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              dba2cb32c21c4b0f575e77bbcdd4fa468056f5e3

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              d95f491ed418dc302db03804daf9335ce21b2df4704587e6851ef03e1f84d895

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              fb13a2f6b64cb7e380a69424d484fc9b8758fa316a7a155ff062bfdacdca8f2c5d2a03898cd099688b1c16a5a0edcecfc42bf0d4d330926b10c3fce9f5238643

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI46642\cryptography-44.0.0.dist-info\RECORD
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              15KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              f15ef7175220c9f59f90bbbaeda16dbd

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              5367cac8814d7a54e1c0274ff3f651ed5c6fe5d6

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              04db3839c853d4164576122b7d5a2bab186536dc8f9a4980385e11cf59946114

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              bb0fa967e03d98b9611006df2155bd8ad58a0e8b1a679d636b94ce931d316f18b61b801e018deca90d8e5a35fa744ae8c9e1a36f25c791052008c43af53a8117

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI46642\cryptography-44.0.0.dist-info\WHEEL
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              94B

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              a868f93fcf51c4f1c25658d54f994349

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              535c88a10911673deabb7889d365e81729e483a6

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              1e7f5bcad669386a11e8ce14e715131c2d402693c3f41d713eb338493c658c45

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              ec13cac9df03676640ef5da033e8c2faee63916f27cc27b9c43f0824b98ab4a6ecb4c8d7d039fa6674ef189bdd9265c8ed509c1d80dff610aeb9e081093aeb3d

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI46642\cryptography-44.0.0.dist-info\licenses\LICENSE
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              197B

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              8c3617db4fb6fae01f1d253ab91511e4

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              e442040c26cd76d1b946822caf29011a51f75d6d

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              3e0c7c091a948b82533ba98fd7cbb40432d6f1a9acbf85f5922d2f99a93ae6bb

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              77a1919e380730bcce5b55d76fbffba2f95874254fad955bd2fe1de7fc0e4e25b5fdaab0feffd6f230fa5dc895f593cf8bfedf8fdc113efbd8e22fadab0b8998

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI46642\cryptography-44.0.0.dist-info\licenses\LICENSE.APACHE
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              11KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              4e168cce331e5c827d4c2b68a6200e1b

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              de33ead2bee64352544ce0aa9e410c0c44fdf7d9

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              aac73b3148f6d1d7111dbca32099f68d26c644c6813ae1e4f05f6579aa2663fe

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              f451048e81a49fbfa11b49de16ff46c52a8e3042d1bcc3a50aaf7712b097bed9ae9aed9149c21476c2a1e12f1583d4810a6d36569e993fe1ad3879942e5b0d52

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI46642\cryptography-44.0.0.dist-info\licenses\LICENSE.BSD
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              1KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              5ae30ba4123bc4f2fa49aa0b0dce887b

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              ea5b412c09f3b29ba1d81a61b878c5c16ffe69d8

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              602c4c7482de6479dd2e9793cda275e5e63d773dacd1eca689232ab7008fb4fb

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              ddbb20c80adbc8f4118c10d3e116a5cd6536f72077c5916d87258e155be561b89eb45c6341a1e856ec308b49a4cb4dba1408eabd6a781fbe18d6c71c32b72c41

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI46642\cryptography\hazmat\bindings\_rust.pyd
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              2.0MB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              606a84af5a9cf8ad3cb0314e77fb7209

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              6de88d8554488ffe3e48c9b14886da16d1703a69

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              0693ffa4990fa8c1664485f3d2a41b581eac0b340d07d62242052a67bf2ed5c3

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              97d451f025aefb487c5cea568eb430356adfe23908321f1c04f8fa4c03df87507eda8d9612c944be4fa733df4cec38a0e37bffd8865088064b749244d4321b1f

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI46642\frozenlist\_frozenlist.cp310-win_amd64.pyd
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              36KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              219ad30aea7630a3696df28231405927

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              ebaf69903305ea0803570cc2ff4cf43dd2bc812a

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              06d38127de4cbd3243f861ea22897d490520e913f77011a37d915c4992433604

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              72eb7323deb26931ea000690f85272ee71e19b2896af2b43ccd8bcfc3a299e0f8a7a3f1e339fbfe7c855e081cd94e21ae09ba3b8e2d16dbacddb838c31b4de13

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_na3twwdl.zj2.ps1
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              60B

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • memory/1504-318-0x00007FFFFD950000-0x00007FFFFD96B000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              108KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1504-166-0x00007FFFFD970000-0x00007FFFFD992000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              136KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1504-164-0x00007FFFFD9A0000-0x00007FFFFD9B4000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              80KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1504-170-0x00007FF8043A0000-0x00007FF8043BF000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              124KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1504-161-0x00007FFFFD9C0000-0x00007FFFFD9D4000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              80KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1504-171-0x00007FFFF33C0000-0x00007FFFF3531000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              1.4MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1504-159-0x00007FF804410000-0x00007FF804429000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              100KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1504-158-0x00007FF808720000-0x00007FF808730000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              64KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1504-157-0x00007FF801110000-0x00007FF801125000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              84KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1504-172-0x00007FFFF2F20000-0x00007FFFF3038000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              1.1MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1504-153-0x00007FF808730000-0x00007FF808754000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1504-152-0x00007FFFF3040000-0x00007FFFF33B5000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              3.5MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1504-151-0x0000021439400000-0x0000021439775000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              3.5MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1504-149-0x00007FFFF3540000-0x00007FFFF39AE000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              4.4MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1504-145-0x00007FF804370000-0x00007FF80439E000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              184KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1504-177-0x00007FF804370000-0x00007FF80439E000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              184KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1504-143-0x00007FFFF33C0000-0x00007FFFF3531000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              1.4MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1504-178-0x00007FFFFD930000-0x00007FFFFD948000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              96KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1504-183-0x00007FF8037E0000-0x00007FF803898000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              736KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1504-139-0x00007FF8043C0000-0x00007FF8043ED000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              180KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1504-186-0x00007FFFF3040000-0x00007FFFF33B5000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              3.5MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1504-137-0x00007FF8043F0000-0x00007FF804409000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              100KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1504-270-0x00007FF80C330000-0x00007FF80C33D000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              52KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1504-135-0x00007FF80E660000-0x00007FF80E66D000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              52KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1504-134-0x00007FF804410000-0x00007FF804429000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              100KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1504-269-0x00007FFFFD970000-0x00007FFFFD992000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              136KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1504-187-0x00007FFFFBC40000-0x00007FFFFBC8D000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              308KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1504-188-0x00007FF8086D0000-0x00007FF8086DA000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              40KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1504-189-0x00007FFFFD910000-0x00007FFFFD921000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              68KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1504-190-0x00007FFFF67B0000-0x00007FFFF67E2000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              200KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1504-193-0x00007FFFF64C0000-0x00007FFFF64F7000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              220KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1504-192-0x00007FFFF2720000-0x00007FFFF2F1B000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              8.0MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1504-110-0x00007FF808730000-0x00007FF808754000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1504-191-0x00007FFFFBC20000-0x00007FFFFBC3E000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              120KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1504-185-0x0000021439400000-0x0000021439775000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              3.5MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1504-173-0x00007FFFFD950000-0x00007FFFFD96B000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              108KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1504-150-0x00007FF8037E0000-0x00007FF803898000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              736KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1504-102-0x00007FFFF3540000-0x00007FFFF39AE000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              4.4MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1504-131-0x00007FF80E6E0000-0x00007FF80E6EF000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              60KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1504-334-0x00007FFFFD930000-0x00007FFFFD948000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              96KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1504-489-0x00007FFFF3540000-0x00007FFFF39AE000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              4.4MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1504-498-0x00007FF804370000-0x00007FF80439E000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              184KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1504-336-0x00007FFFFBC40000-0x00007FFFFBC8D000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              308KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1504-499-0x00007FF8037E0000-0x00007FF803898000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              736KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1504-500-0x00007FFFF3040000-0x00007FFFF33B5000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              3.5MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1504-501-0x00007FF801110000-0x00007FF801125000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              84KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1504-502-0x00007FF808720000-0x00007FF808730000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              64KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1504-340-0x00007FFFF2720000-0x00007FFFF2F1B000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              8.0MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1504-490-0x00007FF808730000-0x00007FF808754000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1504-496-0x00007FF8043A0000-0x00007FF8043BF000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              124KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1504-345-0x00007FF80C330000-0x00007FF80C33D000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              52KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1504-497-0x00007FFFF33C0000-0x00007FFFF3531000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              1.4MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1504-141-0x00007FF8043A0000-0x00007FF8043BF000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              124KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1984-368-0x00007FFFEEAF0000-0x00007FFFEEC08000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              1.1MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1984-403-0x00007FFFF2650000-0x00007FFFF269D000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              308KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1984-348-0x00000132417F0000-0x0000013241B65000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              3.5MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1984-351-0x00007FF807040000-0x00007FF807064000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1984-355-0x00007FFFF0140000-0x00007FFFF0154000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              80KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1984-354-0x00007FFFF03D0000-0x00007FFFF03E4000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              80KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1984-353-0x00007FF803570000-0x00007FF803580000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              64KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1984-365-0x00007FF8010F0000-0x00007FF801109000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              100KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1984-349-0x00007FFFF5F90000-0x00007FFFF63FE000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              4.4MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1984-367-0x00007FFFF0060000-0x00007FFFF007B000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              108KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1984-366-0x00007FFFF0080000-0x00007FFFF00A2000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              136KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1984-352-0x00007FFFF03F0000-0x00007FFFF0405000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              84KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1984-369-0x00007FFFF26A0000-0x00007FFFF26B8000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              96KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1984-370-0x00007FFFF24F0000-0x00007FFFF250F000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              124KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1984-371-0x00007FFFF2650000-0x00007FFFF269D000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              308KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1984-373-0x00007FFFF0710000-0x00007FFFF0742000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              200KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1984-375-0x00007FFFF0210000-0x00007FFFF02C8000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              736KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1984-376-0x00000132417F0000-0x0000013241B65000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              3.5MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1984-377-0x00007FFFFD900000-0x00007FFFFD90A000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              40KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1984-374-0x00007FFFF24C0000-0x00007FFFF24EE000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              184KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1984-372-0x00007FFFF2630000-0x00007FFFF2641000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              68KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1984-379-0x00007FFFF2610000-0x00007FFFF262E000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              120KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1984-378-0x00007FFFEF840000-0x00007FFFEFBB5000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              3.5MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1984-380-0x00007FFFE93B0000-0x00007FFFE9BAB000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              8.0MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1984-382-0x00007FFFF07C0000-0x00007FFFF07F7000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              220KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1984-414-0x00007FF8010F0000-0x00007FF801109000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              100KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1984-413-0x00007FF806CD0000-0x00007FF806CDF000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              60KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1984-412-0x00007FF807040000-0x00007FF807064000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1984-411-0x00007FFFF5F90000-0x00007FFFF63FE000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              4.4MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1984-410-0x00007FFFFC270000-0x00007FFFFC289000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              100KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1984-409-0x00007FFFF07C0000-0x00007FFFF07F7000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              220KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1984-408-0x00007FFFE93B0000-0x00007FFFE9BAB000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              8.0MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1984-407-0x00007FFFF2610000-0x00007FFFF262E000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              120KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1984-406-0x00007FFFFD900000-0x00007FFFFD90A000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              40KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1984-404-0x00007FFFF2630000-0x00007FFFF2641000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              68KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1984-350-0x00007FFFEF840000-0x00007FFFEFBB5000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              3.5MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1984-402-0x00007FFFF26A0000-0x00007FFFF26B8000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              96KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1984-401-0x00007FFFF0060000-0x00007FFFF007B000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              108KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1984-400-0x00007FFFEEAF0000-0x00007FFFEEC08000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              1.1MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1984-399-0x00007FFFF0080000-0x00007FFFF00A2000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              136KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1984-398-0x00007FFFF0140000-0x00007FFFF0154000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              80KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1984-397-0x00007FFFF03D0000-0x00007FFFF03E4000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              80KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1984-396-0x00007FF803570000-0x00007FF803580000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              64KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1984-395-0x00007FFFF03F0000-0x00007FFFF0405000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              84KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1984-393-0x00007FFFF0210000-0x00007FFFF02C8000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              736KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1984-391-0x00007FFFF0460000-0x00007FFFF05D1000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              1.4MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1984-394-0x00007FFFEF840000-0x00007FFFEFBB5000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              3.5MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1984-347-0x00007FFFF0210000-0x00007FFFF02C8000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              736KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1984-346-0x00007FFFF24C0000-0x00007FFFF24EE000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              184KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1984-344-0x00007FFFF0460000-0x00007FFFF05D1000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              1.4MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1984-343-0x00007FFFF24F0000-0x00007FFFF250F000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              124KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1984-341-0x00007FFFF2510000-0x00007FFFF253D000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              180KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1984-342-0x00007FFFFC270000-0x00007FFFFC289000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              100KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1984-338-0x00007FF8010F0000-0x00007FF801109000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              100KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1984-339-0x00007FF8040A0000-0x00007FF8040AD000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              52KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1984-337-0x00007FF806CD0000-0x00007FF806CDF000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              60KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1984-335-0x00007FF807040000-0x00007FF807064000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1984-332-0x00007FFFF5F90000-0x00007FFFF63FE000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              4.4MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/2136-0-0x00007FFFF4FB3000-0x00007FFFF4FB5000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              8KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/2136-78-0x00007FFFF4FB0000-0x00007FFFF5A72000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              10.8MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/2136-20-0x00007FFFF4FB0000-0x00007FFFF5A72000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              10.8MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/2136-1-0x0000000000770000-0x00000000014EE000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              13.5MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3112-19-0x00007FFFF4FB0000-0x00007FFFF5A72000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              10.8MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3112-16-0x00007FFFF4FB0000-0x00007FFFF5A72000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              10.8MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3112-15-0x00007FFFF4FB0000-0x00007FFFF5A72000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              10.8MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3112-14-0x00007FFFF4FB0000-0x00007FFFF5A72000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              10.8MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3112-13-0x00007FFFF4FB0000-0x00007FFFF5A72000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              10.8MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3112-12-0x00007FFFF4FB0000-0x00007FFFF5A72000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              10.8MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3112-8-0x000001CB4F030000-0x000001CB4F052000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              136KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3868-567-0x00007FF8010F0000-0x00007FF801109000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              100KB

                                                                                                                                                                                                                                                                                                              Download