Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241023-en
  • resource tags

    arch:x64arch:x86image:win11-20241023-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    12/01/2025, 22:09

General

  • Target

    Solara.exe

  • Size

    13.5MB

  • MD5

    6ca6ea858de3f4203df8b8c5c218ad17

  • SHA1

    71a0778b88469b8a62e472f8827465e2e68fbec6

  • SHA256

    421ed8931f574d6dcc86eb7fa2fbb0fc9069aebf22dbc0c4c0f341c7864d3784

  • SHA512

    e6324cd5c130e86038666ed4882a4a7f37f168c771bf6ef86aed19eb6733c2a8a875a01271cd1d82d193c665dbaaf6e21cf12c2ced18d20a1cfb2712f9e0ff00

  • SSDEEP

    393216:NsEANEX3gBGYVwwoE0VhUqE7SlO9h4m/a360m:NhIEX3kGN/XBEWs4EA60m

Malware Config

Signatures

  • Exela Stealer

    Exela Stealer is an open source stealer originally written in .NET and later transitioned to Python that was first observed in August 2023.

  • Exelastealer family
  • Grants admin privileges 1 TTPs

    Uses net.exe to modify the user's privileges.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 64 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Modifies Windows Firewall 2 TTPs 2 IoCs
  • Clipboard Data 1 TTPs 2 IoCs

    Adversaries may collect data stored in the clipboard from users copying information within or between applications.

  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 64 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Network Service Discovery 1 TTPs 2 IoCs

    Attempt to gather information on host's network.

  • Enumerates processes with tasklist 1 TTPs 5 IoCs
  • Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs
  • UPX packed file 64 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Detects Pyinstaller 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • Permission Groups Discovery: Local Groups 1 TTPs

    Attempt to find local system groups and permission settings.

  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

  • System Network Connections Discovery 1 TTPs 1 IoCs

    Attempt to get a listing of network connections.

  • Collects information from the system 1 TTPs 1 IoCs

    Uses WMIC.exe to find detailed system information.

  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Gathers network information 2 TTPs 2 IoCs

    Uses commandline utility to view network configuration.

  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Solara.exe
    "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2548
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1520
    • C:\Users\Admin\AppData\Local\Temp\Solara.exe
      "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
      2⤵
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1104
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2792
      • C:\Users\Admin\AppData\Local\Temp\Solara.exe
        "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
        3⤵
          PID:1556
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
            4⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            PID:688
          • C:\Users\Admin\AppData\Local\Temp\Solara.exe
            "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
            4⤵
            • Adds Run key to start application
            PID:3484
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
              5⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:3144
            • C:\Users\Admin\AppData\Local\Temp\Solara.exe
              "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
              5⤵
              • Adds Run key to start application
              PID:672
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                6⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                PID:1580
              • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                6⤵
                • Adds Run key to start application
                PID:4392
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                  7⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  PID:1540
                • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                  "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                  7⤵
                    PID:3084
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                      8⤵
                      • Suspicious behavior: EnumeratesProcesses
                      PID:1732
                      • C:\Windows\System32\Conhost.exe
                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                        9⤵
                          PID:2656
                      • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                        "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                        8⤵
                        • Adds Run key to start application
                        PID:4896
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                          9⤵
                          • Command and Scripting Interpreter: PowerShell
                          • Suspicious behavior: EnumeratesProcesses
                          PID:764
                        • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                          "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                          9⤵
                          • Adds Run key to start application
                          PID:1872
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                            10⤵
                            • Command and Scripting Interpreter: PowerShell
                            • Suspicious behavior: EnumeratesProcesses
                            PID:3908
                          • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                            "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                            10⤵
                            • Adds Run key to start application
                            PID:4756
                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                              11⤵
                              • Command and Scripting Interpreter: PowerShell
                              • Suspicious behavior: EnumeratesProcesses
                              PID:2624
                            • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                              "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                              11⤵
                              • Adds Run key to start application
                              PID:5044
                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                                12⤵
                                • Suspicious behavior: EnumeratesProcesses
                                PID:3356
                              • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                                "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                                12⤵
                                  PID:5112
                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                                    13⤵
                                    • Command and Scripting Interpreter: PowerShell
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:4508
                                  • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                                    "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                                    13⤵
                                      PID:2228
                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                                        14⤵
                                        • Command and Scripting Interpreter: PowerShell
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:3564
                                      • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                                        "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                                        14⤵
                                        • Adds Run key to start application
                                        PID:5104
                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                                          15⤵
                                          • Suspicious behavior: EnumeratesProcesses
                                          PID:1516
                                        • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                                          "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                                          15⤵
                                          • Adds Run key to start application
                                          PID:2196
                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                                            16⤵
                                            • Command and Scripting Interpreter: PowerShell
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:4160
                                          • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                                            "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                                            16⤵
                                            • Adds Run key to start application
                                            PID:1436
                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                                              17⤵
                                              • Command and Scripting Interpreter: PowerShell
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:8
                                            • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                                              "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                                              17⤵
                                                PID:2432
                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                                                  18⤵
                                                    PID:2004
                                                  • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                                                    18⤵
                                                    • Adds Run key to start application
                                                    PID:4788
                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                                                      19⤵
                                                        PID:4164
                                                      • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                                                        19⤵
                                                        • Adds Run key to start application
                                                        PID:2484
                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                                                          20⤵
                                                          • Command and Scripting Interpreter: PowerShell
                                                          PID:2996
                                                        • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                                                          20⤵
                                                          • Adds Run key to start application
                                                          PID:3744
                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                                                            21⤵
                                                            • Command and Scripting Interpreter: PowerShell
                                                            PID:4848
                                                          • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                                                            21⤵
                                                            • Adds Run key to start application
                                                            PID:4720
                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                                                              22⤵
                                                                PID:4368
                                                              • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                                                                22⤵
                                                                • Adds Run key to start application
                                                                PID:1964
                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                                                                  23⤵
                                                                  • Command and Scripting Interpreter: PowerShell
                                                                  PID:3420
                                                                • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                                                                  23⤵
                                                                  • Adds Run key to start application
                                                                  PID:3916
                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                                                                    24⤵
                                                                      PID:856
                                                                    • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                                                                      24⤵
                                                                      • Adds Run key to start application
                                                                      PID:1524
                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                                                                        25⤵
                                                                          PID:1208
                                                                        • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                                                                          "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                                                                          25⤵
                                                                          • Adds Run key to start application
                                                                          PID:480
                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                                                                            26⤵
                                                                            • Command and Scripting Interpreter: PowerShell
                                                                            PID:3284
                                                                          • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                                                                            26⤵
                                                                            • Adds Run key to start application
                                                                            PID:4432
                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                                                                              27⤵
                                                                              • Command and Scripting Interpreter: PowerShell
                                                                              PID:3140
                                                                            • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                                                                              27⤵
                                                                              • Adds Run key to start application
                                                                              PID:4932
                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                                                                                28⤵
                                                                                  PID:4668
                                                                                • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                                                                                  "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                                                                                  28⤵
                                                                                  • Adds Run key to start application
                                                                                  PID:3744
                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                                                                                    29⤵
                                                                                      PID:1724
                                                                                    • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                                                                                      "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                                                                                      29⤵
                                                                                      • Adds Run key to start application
                                                                                      PID:2264
                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                                                                                        30⤵
                                                                                        • Command and Scripting Interpreter: PowerShell
                                                                                        PID:4652
                                                                                      • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                                                                                        30⤵
                                                                                        • Adds Run key to start application
                                                                                        PID:4376
                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                                                                                          31⤵
                                                                                            PID:4360
                                                                                          • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                                                                                            31⤵
                                                                                            • Adds Run key to start application
                                                                                            PID:1772
                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                                                                                              32⤵
                                                                                                PID:4160
                                                                                              • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                                                                                                32⤵
                                                                                                • Adds Run key to start application
                                                                                                PID:4144
                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                                                                                                  33⤵
                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                  PID:2856
                                                                                                • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                                                                                                  33⤵
                                                                                                  • Adds Run key to start application
                                                                                                  PID:2032
                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                                                                                                    34⤵
                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                    PID:2740
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                                                                                                    34⤵
                                                                                                    • Adds Run key to start application
                                                                                                    PID:3152
                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                                                                                                      35⤵
                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                      PID:2264
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                                                                                                      35⤵
                                                                                                      • Adds Run key to start application
                                                                                                      PID:2012
                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                                                                                                        36⤵
                                                                                                          PID:5116
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                                                                                                          36⤵
                                                                                                          • Adds Run key to start application
                                                                                                          PID:5036
                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                                                                                                            37⤵
                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                            PID:1812
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                                                                                                            37⤵
                                                                                                            • Adds Run key to start application
                                                                                                            PID:4164
                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                                                                                                              38⤵
                                                                                                              • Command and Scripting Interpreter: PowerShell
                                                                                                              PID:852
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                                                                                                              38⤵
                                                                                                              • Adds Run key to start application
                                                                                                              PID:4144
                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                                                                                                                39⤵
                                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                                PID:2228
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                                                                                                                39⤵
                                                                                                                • Adds Run key to start application
                                                                                                                PID:1748
                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                                                                                                                  40⤵
                                                                                                                    PID:1128
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                                                                                                                    40⤵
                                                                                                                    • Adds Run key to start application
                                                                                                                    PID:3820
                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                                                                                                                      41⤵
                                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                                      PID:4280
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                                                                                                                      41⤵
                                                                                                                      • Adds Run key to start application
                                                                                                                      PID:2256
                                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                                                                                                                        42⤵
                                                                                                                          PID:2204
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                                                                                                                          42⤵
                                                                                                                            PID:552
                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                                                                                                                              43⤵
                                                                                                                              • Command and Scripting Interpreter: PowerShell
                                                                                                                              PID:1804
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                                                                                                                              43⤵
                                                                                                                                PID:2236
                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                                                                                                                                  44⤵
                                                                                                                                    PID:1300
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                                                                                                                                    44⤵
                                                                                                                                      PID:3008
                                                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                                                                                                                                        45⤵
                                                                                                                                        • Command and Scripting Interpreter: PowerShell
                                                                                                                                        PID:2240
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                                                                                                                                        45⤵
                                                                                                                                        • Adds Run key to start application
                                                                                                                                        PID:2996
                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                                                                                                                                          46⤵
                                                                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                                                                          PID:1572
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                                                                                                                                          46⤵
                                                                                                                                            PID:2836
                                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                                                                                                                                              47⤵
                                                                                                                                              • Command and Scripting Interpreter: PowerShell
                                                                                                                                              PID:716
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                                                                                                                                              47⤵
                                                                                                                                              • Adds Run key to start application
                                                                                                                                              PID:244
                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                                                                                                                                                48⤵
                                                                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                                                                PID:3744
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                                                                                                                                                48⤵
                                                                                                                                                • Adds Run key to start application
                                                                                                                                                PID:4716
                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                                                                                                                                                  49⤵
                                                                                                                                                    PID:1508
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                                                                                                                                                    49⤵
                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                    PID:764
                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                                                                                                                                                      50⤵
                                                                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                                                                      PID:3956
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                                                                                                                                                      50⤵
                                                                                                                                                        PID:916
                                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                                                                                                                                                          51⤵
                                                                                                                                                            PID:2396
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                                                                                                                                                            51⤵
                                                                                                                                                            • Adds Run key to start application
                                                                                                                                                            PID:1208
                                                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                                                                                                                                                              52⤵
                                                                                                                                                                PID:4664
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                                                                                                                                                                52⤵
                                                                                                                                                                • Adds Run key to start application
                                                                                                                                                                PID:4648
                                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                                                                                                                                                                  53⤵
                                                                                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                  PID:1760
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                                                                                                                                                                  53⤵
                                                                                                                                                                    PID:5116
                                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                    53⤵
                                                                                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                    PID:2876
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                    53⤵
                                                                                                                                                                      PID:484
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                        54⤵
                                                                                                                                                                          PID:3232
                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /c "ver"
                                                                                                                                                                            55⤵
                                                                                                                                                                              PID:3028
                                                                                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                        52⤵
                                                                                                                                                                          PID:5108
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                          52⤵
                                                                                                                                                                            PID:868
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                              53⤵
                                                                                                                                                                                PID:4792
                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "ver"
                                                                                                                                                                                  54⤵
                                                                                                                                                                                    PID:3356
                                                                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                              51⤵
                                                                                                                                                                              • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                              PID:4244
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                              51⤵
                                                                                                                                                                                PID:4208
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                  52⤵
                                                                                                                                                                                    PID:3148
                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "ver"
                                                                                                                                                                                      53⤵
                                                                                                                                                                                        PID:3396
                                                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                                  50⤵
                                                                                                                                                                                    PID:4008
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                    50⤵
                                                                                                                                                                                      PID:1140
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                        51⤵
                                                                                                                                                                                          PID:2876
                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c "ver"
                                                                                                                                                                                            52⤵
                                                                                                                                                                                              PID:2160
                                                                                                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                                        49⤵
                                                                                                                                                                                        • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                        PID:4696
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                        49⤵
                                                                                                                                                                                          PID:3284
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                            50⤵
                                                                                                                                                                                              PID:5108
                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "ver"
                                                                                                                                                                                                51⤵
                                                                                                                                                                                                  PID:3120
                                                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                                            48⤵
                                                                                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                            PID:4048
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                            48⤵
                                                                                                                                                                                              PID:1100
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                49⤵
                                                                                                                                                                                                  PID:1272
                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "ver"
                                                                                                                                                                                                    50⤵
                                                                                                                                                                                                      PID:4868
                                                                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                                                47⤵
                                                                                                                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                PID:3308
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                47⤵
                                                                                                                                                                                                  PID:4160
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                    48⤵
                                                                                                                                                                                                      PID:3772
                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "ver"
                                                                                                                                                                                                        49⤵
                                                                                                                                                                                                          PID:1584
                                                                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                                                    46⤵
                                                                                                                                                                                                      PID:484
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                      46⤵
                                                                                                                                                                                                        PID:3824
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                          47⤵
                                                                                                                                                                                                            PID:400
                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c "ver"
                                                                                                                                                                                                              48⤵
                                                                                                                                                                                                                PID:1756
                                                                                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                                                          45⤵
                                                                                                                                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                          PID:2420
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                          45⤵
                                                                                                                                                                                                            PID:4852
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                              46⤵
                                                                                                                                                                                                                PID:3392
                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "ver"
                                                                                                                                                                                                                  47⤵
                                                                                                                                                                                                                    PID:2196
                                                                                                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                                                              44⤵
                                                                                                                                                                                                              • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                              PID:1616
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                              44⤵
                                                                                                                                                                                                                PID:1812
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                  45⤵
                                                                                                                                                                                                                    PID:4516
                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "ver"
                                                                                                                                                                                                                      46⤵
                                                                                                                                                                                                                        PID:4588
                                                                                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                                                                  43⤵
                                                                                                                                                                                                                    PID:916
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                    43⤵
                                                                                                                                                                                                                      PID:1936
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                        44⤵
                                                                                                                                                                                                                          PID:2076
                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c "ver"
                                                                                                                                                                                                                            45⤵
                                                                                                                                                                                                                              PID:4372
                                                                                                                                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                                                                        42⤵
                                                                                                                                                                                                                          PID:1568
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                          42⤵
                                                                                                                                                                                                                            PID:1948
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                              43⤵
                                                                                                                                                                                                                                PID:932
                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "ver"
                                                                                                                                                                                                                                  44⤵
                                                                                                                                                                                                                                    PID:2516
                                                                                                                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                                                                              41⤵
                                                                                                                                                                                                                              • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                              PID:2924
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                              41⤵
                                                                                                                                                                                                                                PID:2028
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                  42⤵
                                                                                                                                                                                                                                    PID:3568
                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "ver"
                                                                                                                                                                                                                                      43⤵
                                                                                                                                                                                                                                        PID:2432
                                                                                                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                                                                                  40⤵
                                                                                                                                                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                  PID:5060
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                  40⤵
                                                                                                                                                                                                                                    PID:868
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                      41⤵
                                                                                                                                                                                                                                        PID:2092
                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "ver"
                                                                                                                                                                                                                                          42⤵
                                                                                                                                                                                                                                            PID:2312
                                                                                                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                                                                                      39⤵
                                                                                                                                                                                                                                        PID:4184
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                        39⤵
                                                                                                                                                                                                                                          PID:2240
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                            40⤵
                                                                                                                                                                                                                                              PID:4828
                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "ver"
                                                                                                                                                                                                                                                41⤵
                                                                                                                                                                                                                                                  PID:2408
                                                                                                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                                                                                            38⤵
                                                                                                                                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                            PID:4244
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                            38⤵
                                                                                                                                                                                                                                              PID:332
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                                39⤵
                                                                                                                                                                                                                                                  PID:4784
                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "ver"
                                                                                                                                                                                                                                                    40⤵
                                                                                                                                                                                                                                                      PID:1516
                                                                                                                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                                                                                                37⤵
                                                                                                                                                                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                PID:1144
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                                37⤵
                                                                                                                                                                                                                                                  PID:4896
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                                    38⤵
                                                                                                                                                                                                                                                      PID:4124
                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "ver"
                                                                                                                                                                                                                                                        39⤵
                                                                                                                                                                                                                                                          PID:4864
                                                                                                                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                                                                                                    36⤵
                                                                                                                                                                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                    PID:3760
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                                    36⤵
                                                                                                                                                                                                                                                      PID:4208
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                                        37⤵
                                                                                                                                                                                                                                                          PID:3568
                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c "ver"
                                                                                                                                                                                                                                                            38⤵
                                                                                                                                                                                                                                                              PID:3248
                                                                                                                                                                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                                                                                                        35⤵
                                                                                                                                                                                                                                                          PID:716
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                                          35⤵
                                                                                                                                                                                                                                                            PID:4788
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                                              36⤵
                                                                                                                                                                                                                                                                PID:4244
                                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "ver"
                                                                                                                                                                                                                                                                  37⤵
                                                                                                                                                                                                                                                                    PID:4428
                                                                                                                                                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                                                                                                              34⤵
                                                                                                                                                                                                                                                              • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                              PID:1932
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                                              34⤵
                                                                                                                                                                                                                                                                PID:3156
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                                                  35⤵
                                                                                                                                                                                                                                                                    PID:1216
                                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "ver"
                                                                                                                                                                                                                                                                      36⤵
                                                                                                                                                                                                                                                                        PID:2384
                                                                                                                                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                                                                                                                  33⤵
                                                                                                                                                                                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                  PID:4624
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                                                  33⤵
                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                  PID:4880
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                                                    34⤵
                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                    PID:228
                                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "ver"
                                                                                                                                                                                                                                                                      35⤵
                                                                                                                                                                                                                                                                        PID:1404
                                                                                                                                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                                                                                                                  32⤵
                                                                                                                                                                                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                  PID:4504
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                                                  32⤵
                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                  PID:2584
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                                                    33⤵
                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                    PID:3416
                                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "ver"
                                                                                                                                                                                                                                                                      34⤵
                                                                                                                                                                                                                                                                        PID:1584
                                                                                                                                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                                                                                                                  31⤵
                                                                                                                                                                                                                                                                    PID:1420
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                                                    31⤵
                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                    PID:1300
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                                                      32⤵
                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                      PID:4948
                                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "ver"
                                                                                                                                                                                                                                                                        33⤵
                                                                                                                                                                                                                                                                          PID:4208
                                                                                                                                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                                                                                                                    30⤵
                                                                                                                                                                                                                                                                      PID:2408
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                                                      30⤵
                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                      PID:3772
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                                                        31⤵
                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                        PID:1436
                                                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "ver"
                                                                                                                                                                                                                                                                          32⤵
                                                                                                                                                                                                                                                                            PID:2300
                                                                                                                                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                                                                                                                      29⤵
                                                                                                                                                                                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                      PID:4720
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                                                      29⤵
                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                      PID:2240
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                                                        30⤵
                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                        PID:1216
                                                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "ver"
                                                                                                                                                                                                                                                                          31⤵
                                                                                                                                                                                                                                                                            PID:2912
                                                                                                                                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                                                                                                                      28⤵
                                                                                                                                                                                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                      PID:2548
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                                                      28⤵
                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                      PID:2328
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                                                        29⤵
                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                        PID:2636
                                                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "ver"
                                                                                                                                                                                                                                                                          30⤵
                                                                                                                                                                                                                                                                            PID:4320
                                                                                                                                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                                                                                                                      27⤵
                                                                                                                                                                                                                                                                        PID:4128
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                                                        27⤵
                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                        PID:1756
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                                                          28⤵
                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                          PID:720
                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c "ver"
                                                                                                                                                                                                                                                                            29⤵
                                                                                                                                                                                                                                                                              PID:1524
                                                                                                                                                                                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                                                                                                                        26⤵
                                                                                                                                                                                                                                                                        • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                        PID:5060
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                                                        26⤵
                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                        PID:1572
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                                                          27⤵
                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                          PID:228
                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c "ver"
                                                                                                                                                                                                                                                                            28⤵
                                                                                                                                                                                                                                                                              PID:4692
                                                                                                                                                                                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                                                                                                                        25⤵
                                                                                                                                                                                                                                                                        • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                        PID:5004
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                                                        25⤵
                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                        PID:4244
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                                                          26⤵
                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                          PID:4152
                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c "ver"
                                                                                                                                                                                                                                                                            27⤵
                                                                                                                                                                                                                                                                              PID:3948
                                                                                                                                                                                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                                                                                                                        24⤵
                                                                                                                                                                                                                                                                          PID:5052
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                                                          24⤵
                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                          PID:2384
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                                                            25⤵
                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                            PID:1672
                                                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c "ver"
                                                                                                                                                                                                                                                                              26⤵
                                                                                                                                                                                                                                                                                PID:3012
                                                                                                                                                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                                                                                                                          23⤵
                                                                                                                                                                                                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                          PID:3256
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                                                          23⤵
                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                          PID:4104
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                                                            24⤵
                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                            PID:4788
                                                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c "ver"
                                                                                                                                                                                                                                                                              25⤵
                                                                                                                                                                                                                                                                                PID:2120
                                                                                                                                                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                                                                                                                          22⤵
                                                                                                                                                                                                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                          PID:1860
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                                                          22⤵
                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                          PID:4392
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                                                            23⤵
                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                            PID:4712
                                                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c "ver"
                                                                                                                                                                                                                                                                              24⤵
                                                                                                                                                                                                                                                                                PID:2740
                                                                                                                                                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                                                                                                                          21⤵
                                                                                                                                                                                                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                          PID:4036
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                                                          21⤵
                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                          PID:780
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                                                            22⤵
                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                            PID:868
                                                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c "ver"
                                                                                                                                                                                                                                                                              23⤵
                                                                                                                                                                                                                                                                                PID:1436
                                                                                                                                                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                                                                                                                          20⤵
                                                                                                                                                                                                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                          PID:3428
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                                                          20⤵
                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                          PID:4888
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                                                            21⤵
                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                            PID:1356
                                                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c "ver"
                                                                                                                                                                                                                                                                              22⤵
                                                                                                                                                                                                                                                                                PID:484
                                                                                                                                                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                                                                                                                          19⤵
                                                                                                                                                                                                                                                                            PID:1584
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                                                            19⤵
                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                            PID:3016
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                                                              20⤵
                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                              PID:3448
                                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "ver"
                                                                                                                                                                                                                                                                                21⤵
                                                                                                                                                                                                                                                                                  PID:3260
                                                                                                                                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                                                                                                                            18⤵
                                                                                                                                                                                                                                                                              PID:2400
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                                                              18⤵
                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                              PID:568
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                                                                19⤵
                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                PID:1112
                                                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "ver"
                                                                                                                                                                                                                                                                                  20⤵
                                                                                                                                                                                                                                                                                    PID:3324
                                                                                                                                                                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                                                                                                                              17⤵
                                                                                                                                                                                                                                                                                PID:4604
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                                                                17⤵
                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                PID:4952
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                                                                  18⤵
                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                  PID:236
                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "ver"
                                                                                                                                                                                                                                                                                    19⤵
                                                                                                                                                                                                                                                                                      PID:4172
                                                                                                                                                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                                                                                                                                16⤵
                                                                                                                                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                PID:2156
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                                                                16⤵
                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                PID:1632
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                                                                  17⤵
                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                  PID:684
                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "ver"
                                                                                                                                                                                                                                                                                    18⤵
                                                                                                                                                                                                                                                                                      PID:3332
                                                                                                                                                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                                                                                                                                15⤵
                                                                                                                                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                PID:1124
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                                                                15⤵
                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                PID:2004
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                                                                  16⤵
                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                  PID:2992
                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "ver"
                                                                                                                                                                                                                                                                                    17⤵
                                                                                                                                                                                                                                                                                      PID:1660
                                                                                                                                                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                                                                                                                                14⤵
                                                                                                                                                                                                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                PID:900
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                                                                14⤵
                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                PID:4852
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                                                                  15⤵
                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                  PID:4152
                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "ver"
                                                                                                                                                                                                                                                                                    16⤵
                                                                                                                                                                                                                                                                                      PID:4616
                                                                                                                                                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                                                                                                                                13⤵
                                                                                                                                                                                                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                PID:4300
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                                                                13⤵
                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                PID:1724
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                                                                  14⤵
                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                  PID:4792
                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "ver"
                                                                                                                                                                                                                                                                                    15⤵
                                                                                                                                                                                                                                                                                      PID:4796
                                                                                                                                                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                                                                                                                                12⤵
                                                                                                                                                                                                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                PID:1244
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                                                                12⤵
                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                PID:400
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                                                                  13⤵
                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                  PID:1584
                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "ver"
                                                                                                                                                                                                                                                                                    14⤵
                                                                                                                                                                                                                                                                                      PID:424
                                                                                                                                                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                                                                                                                                11⤵
                                                                                                                                                                                                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                PID:4588
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                                                                11⤵
                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                PID:1468
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                                                                  12⤵
                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                  PID:3496
                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "ver"
                                                                                                                                                                                                                                                                                    13⤵
                                                                                                                                                                                                                                                                                      PID:4792
                                                                                                                                                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                                                                                                                                10⤵
                                                                                                                                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                PID:8
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                                                                10⤵
                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                PID:2484
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                                                                  11⤵
                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                  PID:4084
                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "ver"
                                                                                                                                                                                                                                                                                    12⤵
                                                                                                                                                                                                                                                                                      PID:2736
                                                                                                                                                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                                                                                                                                9⤵
                                                                                                                                                                                                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                PID:804
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                                                                9⤵
                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                PID:4392
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                                                                  10⤵
                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                  PID:5076
                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "ver"
                                                                                                                                                                                                                                                                                    11⤵
                                                                                                                                                                                                                                                                                      PID:4372
                                                                                                                                                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                PID:5092
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                PID:3720
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                                                                  9⤵
                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                  PID:2704
                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "ver"
                                                                                                                                                                                                                                                                                    10⤵
                                                                                                                                                                                                                                                                                      PID:4352
                                                                                                                                                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                PID:2432
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                PID:4804
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                  PID:1420
                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "ver"
                                                                                                                                                                                                                                                                                    9⤵
                                                                                                                                                                                                                                                                                      PID:436
                                                                                                                                                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                PID:2976
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                PID:1080
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                  PID:1348
                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "ver"
                                                                                                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                                                                                                      PID:1216
                                                                                                                                                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                PID:2664
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                PID:5076
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                  PID:5092
                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "ver"
                                                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                                                      PID:3260
                                                                                                                                                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                PID:764
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                PID:1040
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                  • Loads dropped DLL
                                                                                                                                                                                                                                                                                  PID:1756
                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "ver"
                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                      PID:716
                                                                                                                                                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                PID:3144
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                PID:3492
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                  • Loads dropped DLL
                                                                                                                                                                                                                                                                                  PID:3020
                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "ver"
                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                      PID:1628
                                                                                                                                                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                PID:4504
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                PID:3488
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                  • Loads dropped DLL
                                                                                                                                                                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                  PID:4568
                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "ver"
                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                      PID:900
                                                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                      PID:2392
                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                                                                        wmic path win32_VideoController get name
                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                        • Detects videocard installed
                                                                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                        PID:1572
                                                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "wmic computersystem get Manufacturer"
                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                      PID:4624
                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                                                                        wmic computersystem get Manufacturer
                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                        PID:1216
                                                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "gdb --version"
                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                        PID:5052
                                                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "tasklist"
                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                        PID:5024
                                                                                                                                                                                                                                                                                        • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                                                                                                          tasklist
                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                          • Enumerates processes with tasklist
                                                                                                                                                                                                                                                                                          PID:112
                                                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "wmic path Win32_ComputerSystem get Manufacturer"
                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                        PID:2712
                                                                                                                                                                                                                                                                                        • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                                                                          wmic path Win32_ComputerSystem get Manufacturer
                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                            PID:3404
                                                                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                          PID:2144
                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                                                                            wmic csproduct get uuid
                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                              PID:1828
                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c "tasklist"
                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                            PID:3740
                                                                                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                PID:1520
                                                                                                                                                                                                                                                                                              • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                                                                                                                tasklist
                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                • Enumerates processes with tasklist
                                                                                                                                                                                                                                                                                                PID:1592
                                                                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe""
                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                              • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                              PID:1540
                                                                                                                                                                                                                                                                                              • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                                                                                                attrib +h +s "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe"
                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                PID:2624
                                                                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c "tasklist"
                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                              PID:1420
                                                                                                                                                                                                                                                                                              • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                                                                                                                tasklist
                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                • Enumerates processes with tasklist
                                                                                                                                                                                                                                                                                                PID:1516
                                                                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                PID:1732
                                                                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                  cmd.exe /c chcp
                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                    PID:4804
                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                      chcp
                                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                                        PID:4800
                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                      PID:4236
                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                        cmd.exe /c chcp
                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                          PID:2656
                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                            chcp
                                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                                              PID:2404
                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                            PID:4920
                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                                                                                                                              tasklist /FO LIST
                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                              • Enumerates processes with tasklist
                                                                                                                                                                                                                                                                                                              PID:3024
                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"
                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                            • Clipboard Data
                                                                                                                                                                                                                                                                                                            PID:1984
                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                              powershell.exe Get-Clipboard
                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                              • Clipboard Data
                                                                                                                                                                                                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                              PID:8
                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                            • System Network Configuration Discovery: Wi-Fi Discovery
                                                                                                                                                                                                                                                                                                            PID:1696
                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\netsh.exe
                                                                                                                                                                                                                                                                                                              netsh wlan show profiles
                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                              • Event Triggered Execution: Netsh Helper DLL
                                                                                                                                                                                                                                                                                                              • System Network Configuration Discovery: Wi-Fi Discovery
                                                                                                                                                                                                                                                                                                              PID:2088
                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"
                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                            • Network Service Discovery
                                                                                                                                                                                                                                                                                                            PID:4792
                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\systeminfo.exe
                                                                                                                                                                                                                                                                                                              systeminfo
                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                              • Gathers system information
                                                                                                                                                                                                                                                                                                              PID:4388
                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\HOSTNAME.EXE
                                                                                                                                                                                                                                                                                                              hostname
                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                PID:4604
                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                                                                                                wmic logicaldisk get caption,description,providername
                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                • Collects information from the system
                                                                                                                                                                                                                                                                                                                PID:1964
                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                                                                                                net user
                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                  PID:2656
                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\net1 user
                                                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                                                      PID:4952
                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\query.exe
                                                                                                                                                                                                                                                                                                                    query user
                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                      PID:3676
                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\quser.exe
                                                                                                                                                                                                                                                                                                                        "C:\Windows\system32\quser.exe"
                                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                                          PID:3288
                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                                                                                                        net localgroup
                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                          PID:1500
                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\net1 localgroup
                                                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                                                              PID:1208
                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                                                                                                            net localgroup administrators
                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                              PID:3976
                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\net1 localgroup administrators
                                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                                  PID:3092
                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                                                                                                                net user guest
                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                  PID:4572
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\net1 user guest
                                                                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                                                                      PID:4576
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                                                                                                                    net user administrator
                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                      PID:4888
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\net1 user administrator
                                                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                                                          PID:2792
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                                                                                                                        wmic startup get caption,command
                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                          PID:4660
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                                                                                                                                                          tasklist /svc
                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                          • Enumerates processes with tasklist
                                                                                                                                                                                                                                                                                                                                          PID:2984
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\ipconfig.exe
                                                                                                                                                                                                                                                                                                                                          ipconfig /all
                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                          • Gathers network information
                                                                                                                                                                                                                                                                                                                                          PID:1080
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\ROUTE.EXE
                                                                                                                                                                                                                                                                                                                                          route print
                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                            PID:1496
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\ARP.EXE
                                                                                                                                                                                                                                                                                                                                            arp -a
                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                            • Network Service Discovery
                                                                                                                                                                                                                                                                                                                                            PID:3324
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\NETSTAT.EXE
                                                                                                                                                                                                                                                                                                                                            netstat -ano
                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                            • System Network Connections Discovery
                                                                                                                                                                                                                                                                                                                                            • Gathers network information
                                                                                                                                                                                                                                                                                                                                            PID:4000
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                                                                                                                                            sc query type= service state= all
                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                            • Launches sc.exe
                                                                                                                                                                                                                                                                                                                                            PID:3860
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\netsh.exe
                                                                                                                                                                                                                                                                                                                                            netsh firewall show state
                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                            • Modifies Windows Firewall
                                                                                                                                                                                                                                                                                                                                            • Event Triggered Execution: Netsh Helper DLL
                                                                                                                                                                                                                                                                                                                                            PID:3320
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\netsh.exe
                                                                                                                                                                                                                                                                                                                                            netsh firewall show config
                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                            • Modifies Windows Firewall
                                                                                                                                                                                                                                                                                                                                            • Event Triggered Execution: Netsh Helper DLL
                                                                                                                                                                                                                                                                                                                                            PID:3828
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                            PID:4788
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                                PID:2656
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                                                                                                                                wmic csproduct get uuid
                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                  PID:3852
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                  PID:2648
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                                                                                                                                    wmic csproduct get uuid
                                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                                      PID:2068

                                                                                                                                                                                                                                                                                                                                            Network

                                                                                                                                                                                                                                                                                                                                            MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                                                                                                            Replay Monitor

                                                                                                                                                                                                                                                                                                                                            Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                            Downloads

                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              2KB

                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                              5ba388a6597d5e09191c2c88d2fdf598

                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                              13516f8ec5a99298f6952438055c39330feae5d8

                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                              e6b6223094e8fc598ad12b3849e49f03a141ccd21e0eaa336f81791ad8443eca

                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                              ead2a2b5a1c2fad70c1cf570b2c9bfcb7364dd9f257a834eb819e55b8fee78e3f191f93044f07d51c259ca77a90ee8530f9204cbae080fba1d5705e1209f5b19

                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              944B

                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                              81dc356768c666a613df994ba756b09f

                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                              0f6768127d68715e688518e7a7d9159114e71d11

                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                              f12f8ba2539036e660cf18f58da225e0d3571906b89797bc5308b745423e79bb

                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                              83f7344aba829fb83dcff48d2c9be8e4ccd6d1d3659d1b77e6867852002166f5fd1e45649dc97bec5283370ed46963ea5aa7d43db446fb2d6544dde2a1b1c605

                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              944B

                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                              979db644c2cade95abc261f491bf3b6c

                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                              251e5cde0a34f14694f95c681dc7cfe63bd60844

                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                              3781dd13cdbb9b2639aafb7e49da7e37ef6e3bb03151240764819a46b7a13cb9

                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                              7114c56e51c5212d951093d72c98ef7a31055693b1de7b1709347c4af27ed5eadf758e1b0d0faafdbf54252da2ddba571118d9f11dd9bf480bd7fe17e71c5464

                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              944B

                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                              6f0e62045515b66d0a0105abc22dbf19

                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                              894d685122f3f3c9a3457df2f0b12b0e851b394c

                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                              529811e4d3496c559f3bd92cd877b93b719c3ac4834202aa76ab9e16e25f9319

                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                              f78426df6032ee77f8c463446ab1c6bb4669ef7a2463dead831ec4ff83a07d7dc702d79372d8bcaf4594bf0fb6e11e9f027f3e0325de9b19be5f51b7b80ed54a

                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              944B

                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                              cef328ddb1ee8916e7a658919323edd8

                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                              a676234d426917535e174f85eabe4ef8b88256a5

                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                              a1b5b7ada8ebc910f20f91ada3991d3321104e9da598c958b1edac9f9aca0e90

                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                              747400c20ca5b5fd1b54bc24e75e6a78f15af61df263be932d2ee7b2f34731c2de8ce03b2706954fb098c1ac36f0b761cf37e418738fa91f2a8ea78572f545cb

                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              944B

                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                              df808b11175970c23f00e611a7b6d2cc

                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                              0243f099e483fcafb6838c0055982e65634b6db6

                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                              2d5eec6aeee0c568d08cc1777a67b529dce3133efc761ef4b4643d4b2003d43d

                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                              c7c4e39be7cb6bfda48055cd2b0b05a6b6a71131a124730f62928600a5870303e06e3db54634c45f86310413126d2524f51002d5f36f7012e41b641992b5ac89

                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Exela.exe

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              9.5MB

                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                              0615d49be12c174704a3daad945f7b56

                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                              90d67801dcff362ce2c2accafd5010c7f79567d6

                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                              573a7f2fa701a7630318119d9e6d916cb8a0acd87a0a2797b7197e9ae85c0071

                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                              40d702b8fd2993aeeb09755e760d3611d76f927ae6831ab7066386d3a133257e06330ddff2d28406b77c1d9e502e79a7a72b8984ce0d795948da07dd03b9bea9

                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI10402\attrs-24.3.0.dist-info\INSTALLER

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              4B

                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                              365c9bfeb7d89244f2ce01c1de44cb85

                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                              d7a03141d5d6b1e88b6b59ef08b6681df212c599

                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                              ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508

                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                              d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1

                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI10802\attrs-24.3.0.dist-info\METADATA

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              11KB

                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                              0e682e7854fe836cad441326ab36d36d

                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                              3efad7961f8f2dfb0a22a1eeabd3a92b9da0ab23

                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                              7fd8611027805324bb89ec073d1b8c2c3cb5b6927abf2cbc47f4ca5270a6880f

                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                              54fd3b0c98dce7c11691d08ca22c9c8a74cd838d03723dda3fbac326efc2550edb892f9d45aa3956c9c5c35b8c20fe096f6a002dee07150b437a1e7e76ac175a

                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI10802\attrs-24.3.0.dist-info\RECORD

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              3KB

                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                              72c9f466183f7eae813f25ed47198941

                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                              7498fae0d90f7f64d6c954849225e82c8f1bac92

                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                              a237de627ee31b429fed81bdff4fa5b5b22bc979a2580e1205acaedc78761143

                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                              6ed2a1293fa6e27ca3bdaa95af38e3b2299d1d77b7e0fb2d67552cd8f3acaee5be94d4f3f562e6bc42e6f6c7fc9d302c7bd5b14a1243ef86979e077242173c35

                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI10802\attrs-24.3.0.dist-info\WHEEL

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              87B

                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                              e2fcb0ad9ea59332c808928b4b439e7a

                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                              07311208d4849f821e8af25a89a9985c4503fbd8

                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                              aad0b0a12256807936d52d4a6f88a1773236ae527564a688bab4e3fe780e8724

                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                              d4cb3ca64d69678959c4f59b4d1cb992e8e2e046a6acb92341fd30b8ce862bd81a48cbfa09ec9ae2e735ffec5c12d246d1593a859615adee10984635a9ba8af9

                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI10802\attrs-24.3.0.dist-info\licenses\LICENSE

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              1KB

                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                              5e55731824cf9205cfabeab9a0600887

                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                              243e9dd038d3d68c67d42c0c4ba80622c2a56246

                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                              882115c95dfc2af1eeb6714f8ec6d5cbcabf667caff8729f42420da63f714e9f

                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                              21b242bf6dcbafa16336d77a40e69685d7e64a43cc30e13e484c72a93cd4496a7276e18137dc601b6a8c3c193cb775db89853ecc6d6eb2956deee36826d5ebfe

                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI10802\cryptography-44.0.0.dist-info\METADATA

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              5KB

                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                              526d9ac9d8150602ec9ed8b9f4de7102

                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                              dba2cb32c21c4b0f575e77bbcdd4fa468056f5e3

                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                              d95f491ed418dc302db03804daf9335ce21b2df4704587e6851ef03e1f84d895

                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                              fb13a2f6b64cb7e380a69424d484fc9b8758fa316a7a155ff062bfdacdca8f2c5d2a03898cd099688b1c16a5a0edcecfc42bf0d4d330926b10c3fce9f5238643

                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI10802\cryptography-44.0.0.dist-info\RECORD

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              15KB

                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                              f15ef7175220c9f59f90bbbaeda16dbd

                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                              5367cac8814d7a54e1c0274ff3f651ed5c6fe5d6

                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                              04db3839c853d4164576122b7d5a2bab186536dc8f9a4980385e11cf59946114

                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                              bb0fa967e03d98b9611006df2155bd8ad58a0e8b1a679d636b94ce931d316f18b61b801e018deca90d8e5a35fa744ae8c9e1a36f25c791052008c43af53a8117

                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI10802\cryptography-44.0.0.dist-info\WHEEL

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              94B

                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                              a868f93fcf51c4f1c25658d54f994349

                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                              535c88a10911673deabb7889d365e81729e483a6

                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                              1e7f5bcad669386a11e8ce14e715131c2d402693c3f41d713eb338493c658c45

                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                              ec13cac9df03676640ef5da033e8c2faee63916f27cc27b9c43f0824b98ab4a6ecb4c8d7d039fa6674ef189bdd9265c8ed509c1d80dff610aeb9e081093aeb3d

                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI10802\cryptography-44.0.0.dist-info\licenses\LICENSE

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              197B

                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                              8c3617db4fb6fae01f1d253ab91511e4

                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                              e442040c26cd76d1b946822caf29011a51f75d6d

                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                              3e0c7c091a948b82533ba98fd7cbb40432d6f1a9acbf85f5922d2f99a93ae6bb

                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                              77a1919e380730bcce5b55d76fbffba2f95874254fad955bd2fe1de7fc0e4e25b5fdaab0feffd6f230fa5dc895f593cf8bfedf8fdc113efbd8e22fadab0b8998

                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI10802\cryptography-44.0.0.dist-info\licenses\LICENSE.APACHE

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              11KB

                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                              4e168cce331e5c827d4c2b68a6200e1b

                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                              de33ead2bee64352544ce0aa9e410c0c44fdf7d9

                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                              aac73b3148f6d1d7111dbca32099f68d26c644c6813ae1e4f05f6579aa2663fe

                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                              f451048e81a49fbfa11b49de16ff46c52a8e3042d1bcc3a50aaf7712b097bed9ae9aed9149c21476c2a1e12f1583d4810a6d36569e993fe1ad3879942e5b0d52

                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI10802\cryptography-44.0.0.dist-info\licenses\LICENSE.BSD

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              1KB

                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                              5ae30ba4123bc4f2fa49aa0b0dce887b

                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                              ea5b412c09f3b29ba1d81a61b878c5c16ffe69d8

                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                              602c4c7482de6479dd2e9793cda275e5e63d773dacd1eca689232ab7008fb4fb

                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                              ddbb20c80adbc8f4118c10d3e116a5cd6536f72077c5916d87258e155be561b89eb45c6341a1e856ec308b49a4cb4dba1408eabd6a781fbe18d6c71c32b72c41

                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI10802\cryptography\hazmat\bindings\_rust.pyd

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              2.0MB

                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                              606a84af5a9cf8ad3cb0314e77fb7209

                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                              6de88d8554488ffe3e48c9b14886da16d1703a69

                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                              0693ffa4990fa8c1664485f3d2a41b581eac0b340d07d62242052a67bf2ed5c3

                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                              97d451f025aefb487c5cea568eb430356adfe23908321f1c04f8fa4c03df87507eda8d9612c944be4fa733df4cec38a0e37bffd8865088064b749244d4321b1f

                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI10802\frozenlist\_frozenlist.cp310-win_amd64.pyd

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              36KB

                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                              219ad30aea7630a3696df28231405927

                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                              ebaf69903305ea0803570cc2ff4cf43dd2bc812a

                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                              06d38127de4cbd3243f861ea22897d490520e913f77011a37d915c4992433604

                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                              72eb7323deb26931ea000690f85272ee71e19b2896af2b43ccd8bcfc3a299e0f8a7a3f1e339fbfe7c855e081cd94e21ae09ba3b8e2d16dbacddb838c31b4de13

                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI34882\VCRUNTIME140.dll

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              106KB

                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                              870fea4e961e2fbd00110d3783e529be

                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                              a948e65c6f73d7da4ffde4e8533c098a00cc7311

                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                              76fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644

                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                              0b636a3cdefa343eb4cb228b391bb657b5b4c20df62889cd1be44c7bee94ffad6ec82dc4db79949edef576bff57867e0d084e0a597bf7bf5c8e4ed1268477e88

                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI34882\_asyncio.pyd

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              34KB

                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                              7d4f9a2b793e021f7e37b8448751ed4e

                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                              0ea07b5024501aad5008655cfeae6d96b5da957a

                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                              2293c1b6b0b901832a57a1c4dcb1265c9e92d21177195712c30632a7b63227d4

                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                              af75452279c308c61c3e222a031a8201e47e8fe44c4e92cb7dab03d56c7e7e3e2a2c589f650c50e0b29e2df175d6f2ff50c8e5e589d17a124bf0a2e0d7886c26

                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI34882\_bz2.pyd

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              46KB

                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                              6250a28b9d0bfefc1254bd78ece7ae9f

                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                              4b07c8e18d23c8ae9d92d7b8d39ae20bc447aecd

                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                              7d43f7105aa4f856239235c67f61044493ee6f95ddf04533189bf5ea98073f0b

                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                              6d0aa5c3f8f5b268b94341dfdd5afbe48f91f9aac143bf59f7f5e8ba6f54205b85ec527c53498ed8860fdff6a8d08e48ec4e1652eeab2d3c89aaaf3a14fcaaa7

                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI34882\_cffi_backend.cp310-win_amd64.pyd

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              71KB

                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                              7727212e7bdbf63b1a39fb7faad24265

                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                              a8fdec19d6690081b2bf55247e8e17657a68ac97

                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                              b0116303e1e903d6eb02a69d05879f38af1640813f4b110cb733ffff6e4e985c

                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                              2b1a27642118dd228791d0d8ba307aa39ab2d9c7d3799cff9f3c0744fe270eeaefe5545a4fda6e74e86fee747e45bf5f6c9ac799950c2b483a16eb3ce85d816a

                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI34882\_ctypes.pyd

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              56KB

                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                              4b90108fabdd64577a84313c765a2946

                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                              245f4628683a3e18bb6f0d1c88aa26fb959ed258

                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                              e1b634628839a45ab08913463e07b6b6b7fd502396d768f43b21da2875b506a1

                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                              91fa069d7cf61c57faad6355f6fd46d702576c4342460dadcedfdcbc07cd9d84486734f0561fa5e1e01668b384c3c07dd779b332f77d0bb6fbdbb8c0cb5091bc

                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI34882\_decimal.pyd

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              103KB

                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                              20985dc78dbd1992382354af5ca28988

                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                              385a3e7a7654e5e4c686399f3a72b235e941e311

                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                              f3620cac68595b8a8495ab044f19a1c89012f50d2fe571b7a1721485f7ff2e43

                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                              61b8ecd2d12b3f785773b98d4bf4af0eb6eb2c61fbea6effb77ec24b2127e888d0ea5fdd8cc298484e0f770d70c87907048fc382faace8e0ca6b49ab106c89f8

                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI34882\_hashlib.pyd

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              33KB

                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                              3b5530f497ff7c127383d0029e680c35

                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                              fb5dc554bb9ff49622184cc16883a7567115c7ca

                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                              5971fcc9758b7f4a12cde2190a323f35a34ab7f97bd8c39cc8f3335223102573

                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                              12ced7ddb0352f8eca3c3cb7c7c2faaf08e617b2dd278d20008051fb6b564b17c3e9ecfa8b0ffe7674154ad533dfbbf1e802accd5e1aef12ece01368da06e85a

                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI34882\_lzma.pyd

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              84KB

                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                              8edbeeccb6f3dbb09389d99d45db5542

                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                              f7e7af2851a5bf22de79a24fe594b5c0435fca8a

                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                              90701973be6b23703e495f6a145bae251a7bb066d3c5f398ec42694fd06a069f

                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                              2a8bf60f2280b9a947578bd7fd49c3ace8e010a3d4b38e370edb511ea0e125df688bbac369d6a3cec9d285a1fa2ad2dac18a0ef30fda46e49a9440418581e501

                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI34882\_multiprocessing.pyd

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              25KB

                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                              4fbc5fd5da9da74c04fe0374387b34d3

                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                              1e9c98db0486f98fb7d8eb9fa57a949494b649b5

                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                              b2347790c87052623710382d3178887f68a79618d6da5174909f46b169236950

                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                              ce87d4512c2ab7c1ad7986e8e1fe790615ae39c7667d234dfc09026ee7e1518b3bfbf7974612811db0c3e5654b35b54e118e23e624bebe027a51d2c8f2a4652a

                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI34882\_overlapped.pyd

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              30KB

                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                              5c1441f6ee11632183a83dac2d22853b

                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                              eef732ff4bab9ea5c8fffb6a93c47cfc8e64dae2

                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                              104e0b0e0e9fec9eb6438683296feeba298d5f23b02d2080577fc87ffec67acf

                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                              e41d3433754a8a3d2c572bb7f3902c0d37cba2e6f3307f0e6dfed316a22b11ef7e52a73c30085fa89fcff603e4b76858abe761217c320e38fa2eb95d1777b595

                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI34882\_queue.pyd

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              24KB

                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                              5c4c43763fb1a796134aa5734905c891

                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                              44a5e1ae4806406a239129d77888bd87d291a410

                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                              4edc80e7d331ba0e9338431d407157181190f995821d1cd24f7a7aa2422ece0c

                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                              07bec7e4a85e76cfab2c21776b50ee2bd0454835fcb43b573dee757eca24cbeb4530784bae07de3be90820cee6d72023d9ded395d4f1a4931971db247dc1a71e

                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI34882\_socket.pyd

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              41KB

                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                              53e72716073038c1dd1db65bfdb1254c

                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                              7bf220a02a3b51aa51300b3a9ea7fa48358ca161

                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                              e1fb6927ba2ed014d0ac750af0ee0bb3d49487dd6920848937259606e1e92e1d

                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                              c10d91b6ec82402b0eb05dc31a4703c999f4988e88204b695e009fae5fdcc61e8a6dc4d2879ecf2babc030224048afd2f256b9e7f5c5b6f28762047813be0941

                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI34882\_sqlite3.pyd

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              48KB

                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                              e7d68df8f65fbb0298a45519e2336f32

                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                              ad3c84ad7eb75a61f287b1ba9fd2801567e39b6d

                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                              2473ebaf52723c3751a12117ebbe974e50ecdaeb40b282a12ba4e6aa98492e79

                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                              626204685e9b95310aba51be4a8abaf3b6e152fa35902f64f837303fc4011a4518ee393047ceb45bf377e9d965d169c92bfbb6673475150e159c59b7857ba03e

                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI34882\_ssl.pyd

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              60KB

                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                              7e9d95ac47a2284706318656b4f711d3

                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                              f085104709201c6e64635aeacf1da51599054e55

                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                              38dcb3d0f217785b39c03d4c949dd1e04b70e9eade8a4ad83f026390684059c9

                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                              294a5148d8fcddabd177b776617da7720d9876ac2a1cdf8dd7b9489f0f719600a634346cdfa07da66588de885b0a64d8cccde4d47edbf6305bd2af44ee209118

                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI34882\_uuid.pyd

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              21KB

                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                              59cfd9669367517b384922b2485cb6a7

                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                              1bd44298543204d61d4efd2cd3980ad01071360d

                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                              e02bfad84786560b624efd56df55c88a4ffbd6c7cfc728bf68b6401aa10f849f

                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                              d0dd041d8493c7c19db01ea8477981148726796ce2ab58d3193064123319bd5b68fd57871d1db0aaa08d07f78ab96a3d343051c33ffd406e96b921248ea32665

                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI34882\aiohttp\_http_parser.cp310-win_amd64.pyd

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              81KB

                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                              23df1d1a4bfd29c6c0f89d1a42bbecbb

                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                              b8e5686724223bd5e8ed0b7a3517cdc3005be66a

                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                              10f7967a3c574caea10fd5a94c9b6eba405ed6afec402969424c143566593adc

                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                              75a455a9eb96bd52f0d795188a1120ee14d36944c331d97b4c3da837238bd2928cff29df27c0f17093022d976c0c2e54189babd94c6dc927ac325216c340481a

                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI34882\aiohttp\_http_writer.cp310-win_amd64.pyd

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              24KB

                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                              b0e8cbf64f3728eee12e6e0756e67c95

                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                              71bc5ae8847dac5d0737e6321833a37da655d538

                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                              7a931c3108173c4d8cc4ed7304414fcd3ba67ceff81f84506dcdda8979f5f33b

                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                              622126f5a1fc5e275680bb64648a8cac6a5eaf3e7d6a262f0002afc26cec6d9c3addbba257626ac54189b7f85e5abdfc3809954ce0437046fc64b643a4e8cb5a

                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI34882\aiohttp\_websocket\mask.cp310-win_amd64.pyd

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              19KB

                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                              2b5d378afb9aeb031ed1a84f5c216291

                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                              7955e2ec7e7ffa13e58af098d37c480c8f23ccad

                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                              1d44b957609599fdf3115bb47bd668f560b63d4d84c74c1f7bf1f3dc05246d6a

                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                              9102a95c57024afddb67b6500ce1606a2bf5923aa66f67e21fec23c1efb1c9a0cd77c55417b25c7cdbcda119cd817ea4219a1fe321a2f9300f8bffa99d8b0a31

                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI34882\aiohttp\_websocket\reader_c.cp310-win_amd64.pyd

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              61KB

                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                              2cb730463ee9a2360b568bb54ff283b1

                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                              e63b5d62d281f153ab2c3487f4423bec259e1bd5

                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                              17b026c18dc25b2f8842da41484e39c8e92bd3ff9fe0f6d03f9fdc389991e7ae

                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                              a7891ba2619cc6910c47ffac153ba31a3b17f67f08654f7a1fed380b1f4951673573f5e5a59e45e4edc432b135dbb57bb82c3b4cbdfc265d0daa6fca587ab732

                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI34882\base_library.zip

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              859KB

                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                              9b62388394601020bd24fa9e7b4e9e0a

                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                              06023daf857014770ff38d4ebbd600ba03109f28

                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                              a6993db44fde43c8fdbf3512db50060812924c95f6f60aeb80913380a0b4f3e1

                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                              ac1bfebb36d844a0c5909b34fc1100ff2d1f88a0b71a75aa27b4d2b281a90dcb05259b874e4fdb300572a0c029db96e507b5caefdaf03cc32050dc2b728c654b

                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI34882\libcrypto-1_1.dll

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              1.1MB

                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                              86cfc84f8407ab1be6cc64a9702882ef

                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                              86f3c502ed64df2a5e10b085103c2ffc9e3a4130

                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                              11b89cc5531b2a6b89fbbb406ebe8fb01f0bf789e672131b0354e10f9e091307

                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                              b33f59497127cb1b4c1781693380576187c562563a9e367ce8abc14c97c51053a28af559cdd8bd66181012083e562c8a8771e3d46adeba269a848153a8e9173c

                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI34882\libffi-7.dll

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              23KB

                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                              d50ebf567149ead9d88933561cb87d09

                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                              171df40e4187ebbfdf9aa1d76a33f769fb8a35ed

                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                              6aa8e12ce7c8ad52dd2e3fabeb38a726447849669c084ea63d8e322a193033af

                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                              7bcc9d6d3a097333e1e4b2b23c81ea1b5db7dbdc5d9d62ebaffb0fdfb6cfe86161520ac14dc835d1939be22b9f342531f48da70f765a60b8e2c3d7b9983021de

                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI34882\libssl-1_1.dll

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              203KB

                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                              6cd33578bc5629930329ca3303f0fae1

                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                              f2f8e3248a72f98d27f0cfa0010e32175a18487f

                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                              4150ee603ad2da7a6cb6a895cb5bd928e3a99af7e73c604de1fc224e0809fdb0

                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                              c236a6ccc8577c85509d378c1ef014621cab6f6f4aa26796ff32d8eec8e98ded2e55d358a7d236594f7a48646dc2a6bf25b42a37aed549440d52873ebca4713e

                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI34882\multidict\_multidict.cp310-win_amd64.pyd

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              20KB

                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                              7f691747ce66d3ed05a7c2c53220c8b5

                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                              1d3f247042030cf8cf7c859002941beba5d15776

                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                              7d6472a0d7f1a0740c7fc0d0d0ea6f7c6e7cb2b11b8c623c46a6fae1adb4e228

                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                              b01f0e91039fc5b2782caaa0b3d56d5d1fe9e94424cc536cde9eca73a76747736060042e345af9edc5ef5bf5c154705d2c2dddf35536f305306be25a955a9f06

                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI34882\propcache\_helpers_c.cp310-win_amd64.pyd

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              31KB

                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                              9fe92acae9522cd0044146e1b57c23fa

                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                              ec8875039a387bb4ac302cd533b2fe27dbe75b43

                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                              622077d084db60b50c43a1923d60c02f1900fffa3b5a11dfd34328e6fd341362

                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                              cdf5dae191f9b6c75d5698d49d1a55a00695ac896a0823357ea7bf3332683231cb10b1544ec12fab5cf5a15117a92af18e1266f29ed3d3ccbcb56ff46a421e88

                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI34882\pyexpat.pyd

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              86KB

                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                              46331749084f98bcfe8631d74c5e038f

                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                              5e5510f7a4d03f10d979e0d6a0d2a6f0e53ca347

                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                              21cc4b9ccd69d08d7c1068b1f004ae9454f7ea0a322801860faf0e6f4a24a3df

                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                              edd39ce2d927fb6700a86db07f4f56cab897ef91a320f3e5ecb542ea1be6888dd27a08008e5fa1df3765b0c82d1046a23c8d59e76d11f4e6449d4d6826879589

                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI34882\python3.dll

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              63KB

                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                              c17b7a4b853827f538576f4c3521c653

                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                              6115047d02fbbad4ff32afb4ebd439f5d529485a

                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                              d21e60f3dfbf2bab0cc8a06656721fa3347f026df10297674fc635ebf9559a68

                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                              8e08e702d69df6840781d174c4565e14a28022b40f650fda88d60172be2d4ffd96a3e9426d20718c54072ca0da27e0455cc0394c098b75e062a27559234a3df7

                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI34882\python310.dll

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              1.4MB

                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                              fc7bd515b12e537a39dc93a09b3eaad6

                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                              96f5d4b0967372553cb106539c5566bc184f6167

                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                              461e008b7cdf034f99a566671b87849772873a175aefec6ed00732976f5c4164

                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                              a8433d5b403f898e4eeebd72fce08ebad066ca60aeb0b70e2ae78377babc2acbbae2ac91ab20f813cce4b1dc58c2ad6b3868f18cc8ac0fe7be2bff020eb73122

                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI34882\select.pyd

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              24KB

                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                              3797a47a60b606e25348c67043874fe8

                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                              63a33fedffd52190236a6acd0fc5d9d491e3ac45

                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                              312e9b01d1632840983e8533d1685a64fb87e4538f724a7a59a71b1ba148bbac

                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                              3eb7599825b7b21aaab05e420dd16d4a8eaa21652d232f6e4ede213a232b701401556e44df73cfa20ae855d1adc28304b52d42367b74ebd8e96c2e3d9a9b93e2

                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI34882\sqlite3.dll

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              608KB

                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                              6a3a34c9c67efd6c17d44292e8db8fad

                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                              339b1e514d60d8370eaec1e2f2b71cead999f970

                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                              7b0e840165d65f0f5285476467e4c154c4d936613966b84948110a4614b9cad9

                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                              6f2a1b670d28762745f0d3b961a331cbbb0dec244f8798734b911b3a3bc9519c73a3b26f1e1117725f6f1e880e57cadb562a1450659bca1aae353f6b9575d7f5

                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI34882\unicodedata.pyd

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              287KB

                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                              fed35db31377d515d198e5e446498be2

                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                              62e388d17e17208ea0e881ccd96c75b7b1fbc5f7

                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                              af3cdc9a2a1d923be67244429867a3c5c70835249e3573a03b98d08d148fe24b

                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                              0985528cb0289086ec895e21a8947e04f732d5660460f2e7fa8668bd441c891438781c808bcea9294f348720e3752c10ea65363371f7e75ea48600d016bab72a

                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI34882\yarl\_quoting_c.cp310-win_amd64.pyd

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              41KB

                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                              8640834733897205d9193e1b21084135

                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                              e452ae2dbabcc8691233428dd1da5d23961b047d

                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                              bd209ab04ba8a3a40546832380547a460b1257f4fb4b4012f6fc48f9c36cc476

                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                              365805a31ed3ef7648fa2fac49fecc0646dd5dfcad8468918623d962db6aab08339f510edccdaf1340f8bfc06a4628c070de947cdec55cfabdc3563af2de43e7

                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_sypsdeao.aui.ps1

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              60B

                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                              d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                              6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                              96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                              5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                                                                                                                                                                                                                            • memory/1520-13-0x00007FFDC7DF0000-0x00007FFDC88B2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              10.8MB

                                                                                                                                                                                                                                                                                                                                            • memory/1520-14-0x00007FFDC7DF0000-0x00007FFDC88B2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              10.8MB

                                                                                                                                                                                                                                                                                                                                            • memory/1520-11-0x00000219EB190000-0x00000219EB1B2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              136KB

                                                                                                                                                                                                                                                                                                                                            • memory/1520-12-0x00007FFDC7DF0000-0x00007FFDC88B2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              10.8MB

                                                                                                                                                                                                                                                                                                                                            • memory/1520-17-0x00007FFDC7DF0000-0x00007FFDC88B2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              10.8MB

                                                                                                                                                                                                                                                                                                                                            • memory/1520-18-0x00007FFDC7DF0000-0x00007FFDC88B2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              10.8MB

                                                                                                                                                                                                                                                                                                                                            • memory/1520-10-0x00007FFDC7DF0000-0x00007FFDC88B2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              10.8MB

                                                                                                                                                                                                                                                                                                                                            • memory/1756-528-0x00007FFDD5470000-0x00007FFDD5480000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              64KB

                                                                                                                                                                                                                                                                                                                                            • memory/1756-536-0x00007FFDD5350000-0x00007FFDD5361000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              68KB

                                                                                                                                                                                                                                                                                                                                            • memory/1756-516-0x00007FFDD9090000-0x00007FFDD90B4000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                                                                                                            • memory/1756-517-0x00007FFDDCD10000-0x00007FFDDCD1F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              60KB

                                                                                                                                                                                                                                                                                                                                            • memory/1756-519-0x00007FFDD9060000-0x00007FFDD906D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              52KB

                                                                                                                                                                                                                                                                                                                                            • memory/1756-520-0x00007FFDD9040000-0x00007FFDD9059000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              100KB

                                                                                                                                                                                                                                                                                                                                            • memory/1756-521-0x00007FFDD9010000-0x00007FFDD903D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              180KB

                                                                                                                                                                                                                                                                                                                                            • memory/1756-522-0x00007FFDD8FF0000-0x00007FFDD900F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              124KB

                                                                                                                                                                                                                                                                                                                                            • memory/1756-523-0x00007FFDC6200000-0x00007FFDC6371000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              1.4MB

                                                                                                                                                                                                                                                                                                                                            • memory/1756-524-0x00007FFDD5540000-0x00007FFDD556E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              184KB

                                                                                                                                                                                                                                                                                                                                            • memory/1756-525-0x00007FFDD5480000-0x00007FFDD5538000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              736KB

                                                                                                                                                                                                                                                                                                                                            • memory/1756-527-0x00007FFDD5A10000-0x00007FFDD5A25000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              84KB

                                                                                                                                                                                                                                                                                                                                            • memory/1756-518-0x00007FFDD9070000-0x00007FFDD9089000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              100KB

                                                                                                                                                                                                                                                                                                                                            • memory/1756-529-0x00007FFDD5450000-0x00007FFDD5464000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              80KB

                                                                                                                                                                                                                                                                                                                                            • memory/1756-541-0x00007FFDC6010000-0x00007FFDC6047000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              220KB

                                                                                                                                                                                                                                                                                                                                            • memory/1756-515-0x00007FFDC6380000-0x00007FFDC67EE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              4.4MB

                                                                                                                                                                                                                                                                                                                                            • memory/1756-540-0x0000017BF3490000-0x0000017BF3C8B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              8.0MB

                                                                                                                                                                                                                                                                                                                                            • memory/1756-530-0x00007FFDD5430000-0x00007FFDD5444000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              80KB

                                                                                                                                                                                                                                                                                                                                            • memory/1756-531-0x00007FFDD5400000-0x00007FFDD5422000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              136KB

                                                                                                                                                                                                                                                                                                                                            • memory/1756-532-0x00007FFDC60E0000-0x00007FFDC61F8000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              1.1MB

                                                                                                                                                                                                                                                                                                                                            • memory/1756-533-0x00007FFDD53B0000-0x00007FFDD53CB000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              108KB

                                                                                                                                                                                                                                                                                                                                            • memory/1756-539-0x00007FFDD5390000-0x00007FFDD53AE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              120KB

                                                                                                                                                                                                                                                                                                                                            • memory/1756-534-0x00007FFDD5370000-0x00007FFDD5388000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              96KB

                                                                                                                                                                                                                                                                                                                                            • memory/1756-535-0x00007FFDC6090000-0x00007FFDC60DD000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              308KB

                                                                                                                                                                                                                                                                                                                                            • memory/1756-537-0x00007FFDC6050000-0x00007FFDC6082000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              200KB

                                                                                                                                                                                                                                                                                                                                            • memory/1756-538-0x00007FFDD5340000-0x00007FFDD534A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              40KB

                                                                                                                                                                                                                                                                                                                                            • memory/2548-78-0x00007FFDC7DF0000-0x00007FFDC88B2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              10.8MB

                                                                                                                                                                                                                                                                                                                                            • memory/2548-19-0x00007FFDC7DF0000-0x00007FFDC88B2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              10.8MB

                                                                                                                                                                                                                                                                                                                                            • memory/2548-0-0x00007FFDC7DF3000-0x00007FFDC7DF5000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              8KB

                                                                                                                                                                                                                                                                                                                                            • memory/2548-1-0x0000000000FC0000-0x0000000001D3E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              13.5MB

                                                                                                                                                                                                                                                                                                                                            • memory/3020-357-0x00007FFDC6380000-0x00007FFDC67EE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              4.4MB

                                                                                                                                                                                                                                                                                                                                            • memory/3020-368-0x00007FFDC5F40000-0x00007FFDC62B5000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              3.5MB

                                                                                                                                                                                                                                                                                                                                            • memory/3020-274-0x00007FFDD9060000-0x00007FFDD906D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              52KB

                                                                                                                                                                                                                                                                                                                                            • memory/3020-273-0x00007FFDD9070000-0x00007FFDD9089000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              100KB

                                                                                                                                                                                                                                                                                                                                            • memory/3020-262-0x00007FFDC6380000-0x00007FFDC67EE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              4.4MB

                                                                                                                                                                                                                                                                                                                                            • memory/3020-277-0x00007FFDD9040000-0x00007FFDD9059000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              100KB

                                                                                                                                                                                                                                                                                                                                            • memory/3020-269-0x00007FFDD9090000-0x00007FFDD90B4000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                                                                                                            • memory/3020-278-0x00007FFDD9010000-0x00007FFDD903D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              180KB

                                                                                                                                                                                                                                                                                                                                            • memory/3020-281-0x00007FFDD53F0000-0x00007FFDD5561000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              1.4MB

                                                                                                                                                                                                                                                                                                                                            • memory/3020-280-0x00007FFDD8FF0000-0x00007FFDD900F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              124KB

                                                                                                                                                                                                                                                                                                                                            • memory/3020-369-0x00007FFDD5A10000-0x00007FFDD5A25000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              84KB

                                                                                                                                                                                                                                                                                                                                            • memory/3020-282-0x00007FFDD53C0000-0x00007FFDD53EE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              184KB

                                                                                                                                                                                                                                                                                                                                            • memory/3020-285-0x0000015F2A860000-0x0000015F2ABD5000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              3.5MB

                                                                                                                                                                                                                                                                                                                                            • memory/3020-287-0x00007FFDD9090000-0x00007FFDD90B4000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                                                                                                            • memory/3020-286-0x00007FFDC5F40000-0x00007FFDC62B5000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              3.5MB

                                                                                                                                                                                                                                                                                                                                            • memory/3020-284-0x00007FFDC62C0000-0x00007FFDC6378000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              736KB

                                                                                                                                                                                                                                                                                                                                            • memory/3020-283-0x00007FFDC6380000-0x00007FFDC67EE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              4.4MB

                                                                                                                                                                                                                                                                                                                                            • memory/3020-370-0x00007FFDD5370000-0x00007FFDD5380000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              64KB

                                                                                                                                                                                                                                                                                                                                            • memory/3020-325-0x00007FFDD5340000-0x00007FFDD5354000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              80KB

                                                                                                                                                                                                                                                                                                                                            • memory/3020-326-0x00007FFDCF720000-0x00007FFDCF734000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              80KB

                                                                                                                                                                                                                                                                                                                                            • memory/3020-332-0x00007FFDD53C0000-0x00007FFDD53EE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              184KB

                                                                                                                                                                                                                                                                                                                                            • memory/3020-331-0x00007FFDC25E0000-0x00007FFDC25FB000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              108KB

                                                                                                                                                                                                                                                                                                                                            • memory/3020-330-0x00007FFDC5E20000-0x00007FFDC5F38000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              1.1MB

                                                                                                                                                                                                                                                                                                                                            • memory/3020-329-0x00007FFDD53F0000-0x00007FFDD5561000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              1.4MB

                                                                                                                                                                                                                                                                                                                                            • memory/3020-328-0x00007FFDCF6F0000-0x00007FFDCF712000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              136KB

                                                                                                                                                                                                                                                                                                                                            • memory/3020-327-0x00007FFDD8FF0000-0x00007FFDD900F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              124KB

                                                                                                                                                                                                                                                                                                                                            • memory/3020-324-0x00007FFDD5370000-0x00007FFDD5380000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              64KB

                                                                                                                                                                                                                                                                                                                                            • memory/3020-323-0x00007FFDD5A10000-0x00007FFDD5A25000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              84KB

                                                                                                                                                                                                                                                                                                                                            • memory/3020-343-0x00007FFDC62C0000-0x00007FFDC6378000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              736KB

                                                                                                                                                                                                                                                                                                                                            • memory/3020-350-0x00007FFDC1B50000-0x00007FFDC1B82000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              200KB

                                                                                                                                                                                                                                                                                                                                            • memory/3020-352-0x00007FFDC1B30000-0x00007FFDC1B4E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              120KB

                                                                                                                                                                                                                                                                                                                                            • memory/3020-371-0x00007FFDD5340000-0x00007FFDD5354000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              80KB

                                                                                                                                                                                                                                                                                                                                            • memory/3020-349-0x00007FFDC1B90000-0x00007FFDC1BDD000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              308KB

                                                                                                                                                                                                                                                                                                                                            • memory/3020-348-0x00007FFDD5310000-0x00007FFDD531A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              40KB

                                                                                                                                                                                                                                                                                                                                            • memory/3020-347-0x00007FFDC1E60000-0x00007FFDC1E71000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              68KB

                                                                                                                                                                                                                                                                                                                                            • memory/3020-346-0x00007FFDC1E80000-0x00007FFDC1E98000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              96KB

                                                                                                                                                                                                                                                                                                                                            • memory/3020-353-0x00007FFDD5A10000-0x00007FFDD5A25000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              84KB

                                                                                                                                                                                                                                                                                                                                            • memory/3020-354-0x00007FFDBC0D0000-0x00007FFDBC8CB000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              8.0MB

                                                                                                                                                                                                                                                                                                                                            • memory/3020-345-0x00007FFDC5F40000-0x00007FFDC62B5000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              3.5MB

                                                                                                                                                                                                                                                                                                                                            • memory/3020-344-0x0000015F2A860000-0x0000015F2ABD5000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              3.5MB

                                                                                                                                                                                                                                                                                                                                            • memory/3020-355-0x00007FFDBF170000-0x00007FFDBF1A7000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              220KB

                                                                                                                                                                                                                                                                                                                                            • memory/3020-373-0x00007FFDCF6F0000-0x00007FFDCF712000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              136KB

                                                                                                                                                                                                                                                                                                                                            • memory/3020-385-0x00007FFDC25E0000-0x00007FFDC25FB000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              108KB

                                                                                                                                                                                                                                                                                                                                            • memory/3020-384-0x00007FFDD9060000-0x00007FFDD906D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              52KB

                                                                                                                                                                                                                                                                                                                                            • memory/3020-383-0x00007FFDBF170000-0x00007FFDBF1A7000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              220KB

                                                                                                                                                                                                                                                                                                                                            • memory/3020-381-0x00007FFDC1B30000-0x00007FFDC1B4E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              120KB

                                                                                                                                                                                                                                                                                                                                            • memory/3020-380-0x00007FFDD5310000-0x00007FFDD531A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              40KB

                                                                                                                                                                                                                                                                                                                                            • memory/3020-379-0x00007FFDC1B50000-0x00007FFDC1B82000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              200KB

                                                                                                                                                                                                                                                                                                                                            • memory/3020-378-0x00007FFDC1E60000-0x00007FFDC1E71000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              68KB

                                                                                                                                                                                                                                                                                                                                            • memory/3020-376-0x00007FFDC1E80000-0x00007FFDC1E98000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              96KB

                                                                                                                                                                                                                                                                                                                                            • memory/3020-374-0x00007FFDC5E20000-0x00007FFDC5F38000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              1.1MB

                                                                                                                                                                                                                                                                                                                                            • memory/3020-271-0x00007FFDDCD10000-0x00007FFDDCD1F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              60KB

                                                                                                                                                                                                                                                                                                                                            • memory/3020-365-0x00007FFDD53F0000-0x00007FFDD5561000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              1.4MB

                                                                                                                                                                                                                                                                                                                                            • memory/3020-382-0x00007FFDBC0D0000-0x00007FFDBC8CB000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              8.0MB

                                                                                                                                                                                                                                                                                                                                            • memory/4568-193-0x000002CD9C6A0000-0x000002CD9CA15000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              3.5MB

                                                                                                                                                                                                                                                                                                                                            • memory/4568-140-0x00007FFDD9460000-0x00007FFDD948E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              184KB

                                                                                                                                                                                                                                                                                                                                            • memory/4568-322-0x00007FFDD8EE0000-0x00007FFDD8EED000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              52KB

                                                                                                                                                                                                                                                                                                                                            • memory/4568-279-0x00007FFDC0800000-0x00007FFDC0FFB000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              8.0MB

                                                                                                                                                                                                                                                                                                                                            • memory/4568-270-0x00007FFDD9100000-0x00007FFDD9122000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              136KB

                                                                                                                                                                                                                                                                                                                                            • memory/4568-276-0x00007FFDCDC10000-0x00007FFDCDC42000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              200KB

                                                                                                                                                                                                                                                                                                                                            • memory/4568-272-0x00007FFDCE420000-0x00007FFDCE538000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              1.1MB

                                                                                                                                                                                                                                                                                                                                            • memory/4568-261-0x00007FFDDCE90000-0x00007FFDDCEA0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              64KB

                                                                                                                                                                                                                                                                                                                                            • memory/4568-213-0x00007FFDD9440000-0x00007FFDD9455000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              84KB

                                                                                                                                                                                                                                                                                                                                            • memory/4568-150-0x00007FFDD9440000-0x00007FFDD9455000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              84KB

                                                                                                                                                                                                                                                                                                                                            • memory/4568-153-0x00007FFDDF280000-0x00007FFDDF299000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              100KB

                                                                                                                                                                                                                                                                                                                                            • memory/4568-154-0x00007FFDDCE90000-0x00007FFDDCEA0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              64KB

                                                                                                                                                                                                                                                                                                                                            • memory/4568-159-0x00007FFDD9150000-0x00007FFDD9164000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              80KB

                                                                                                                                                                                                                                                                                                                                            • memory/4568-160-0x00007FFDD9130000-0x00007FFDD9144000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              80KB

                                                                                                                                                                                                                                                                                                                                            • memory/4568-161-0x00007FFDD9100000-0x00007FFDD9122000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              136KB

                                                                                                                                                                                                                                                                                                                                            • memory/4568-163-0x00007FFDCE420000-0x00007FFDCE538000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              1.1MB

                                                                                                                                                                                                                                                                                                                                            • memory/4568-184-0x00007FFDD9230000-0x00007FFDD93A1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              1.4MB

                                                                                                                                                                                                                                                                                                                                            • memory/4568-185-0x00007FFDD59F0000-0x00007FFDD5A08000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              96KB

                                                                                                                                                                                                                                                                                                                                            • memory/4568-186-0x00007FFDC89D0000-0x00007FFDC8A1D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              308KB

                                                                                                                                                                                                                                                                                                                                            • memory/4568-195-0x00007FFDD5570000-0x00007FFDD58E5000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              3.5MB

                                                                                                                                                                                                                                                                                                                                            • memory/4568-196-0x00007FFDC8990000-0x00007FFDC89C7000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              220KB

                                                                                                                                                                                                                                                                                                                                            • memory/4568-187-0x00007FFDD59D0000-0x00007FFDD59E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              68KB

                                                                                                                                                                                                                                                                                                                                            • memory/4568-194-0x00007FFDC0800000-0x00007FFDC0FFB000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              8.0MB

                                                                                                                                                                                                                                                                                                                                            • memory/4568-192-0x00007FFDD9170000-0x00007FFDD9228000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              736KB

                                                                                                                                                                                                                                                                                                                                            • memory/4568-351-0x00007FFDD8EE0000-0x00007FFDD8EED000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              52KB

                                                                                                                                                                                                                                                                                                                                            • memory/4568-275-0x00007FFDD90E0000-0x00007FFDD90FB000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              108KB

                                                                                                                                                                                                                                                                                                                                            • memory/4568-189-0x00007FFDD9E10000-0x00007FFDD9E1A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              40KB

                                                                                                                                                                                                                                                                                                                                            • memory/4568-190-0x00007FFDD9460000-0x00007FFDD948E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              184KB

                                                                                                                                                                                                                                                                                                                                            • memory/4568-191-0x00007FFDD5320000-0x00007FFDD533E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              120KB

                                                                                                                                                                                                                                                                                                                                            • memory/4568-166-0x00007FFDD9BC0000-0x00007FFDD9BDF000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              124KB

                                                                                                                                                                                                                                                                                                                                            • memory/4568-167-0x00007FFDD90E0000-0x00007FFDD90FB000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              108KB

                                                                                                                                                                                                                                                                                                                                            • memory/4568-619-0x00007FFDD9490000-0x00007FFDD98FE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              4.4MB

                                                                                                                                                                                                                                                                                                                                            • memory/4568-627-0x00007FFDD9230000-0x00007FFDD93A1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              1.4MB

                                                                                                                                                                                                                                                                                                                                            • memory/4568-626-0x00007FFDD9BC0000-0x00007FFDD9BDF000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              124KB

                                                                                                                                                                                                                                                                                                                                            • memory/4568-620-0x00007FFDDE050000-0x00007FFDDE074000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                                                                                                            • memory/4568-144-0x00007FFDD9490000-0x00007FFDD98FE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              4.4MB

                                                                                                                                                                                                                                                                                                                                            • memory/4568-146-0x000002CD9C6A0000-0x000002CD9CA15000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              3.5MB

                                                                                                                                                                                                                                                                                                                                            • memory/4568-147-0x00007FFDD5570000-0x00007FFDD58E5000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              3.5MB

                                                                                                                                                                                                                                                                                                                                            • memory/4568-148-0x00007FFDDE050000-0x00007FFDDE074000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                                                                                                            • memory/4568-145-0x00007FFDD9170000-0x00007FFDD9228000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              736KB

                                                                                                                                                                                                                                                                                                                                            • memory/4568-132-0x00007FFDDD200000-0x00007FFDDD219000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              100KB

                                                                                                                                                                                                                                                                                                                                            • memory/4568-134-0x00007FFDD9F10000-0x00007FFDD9F3D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              180KB

                                                                                                                                                                                                                                                                                                                                            • memory/4568-188-0x00007FFDCDC10000-0x00007FFDCDC42000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              200KB

                                                                                                                                                                                                                                                                                                                                            • memory/4568-136-0x00007FFDD9BC0000-0x00007FFDD9BDF000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              124KB

                                                                                                                                                                                                                                                                                                                                            • memory/4568-138-0x00007FFDD9230000-0x00007FFDD93A1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              1.4MB

                                                                                                                                                                                                                                                                                                                                            • memory/4568-130-0x00007FFDE2D20000-0x00007FFDE2D2D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              52KB

                                                                                                                                                                                                                                                                                                                                            • memory/4568-128-0x00007FFDDF280000-0x00007FFDDF299000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              100KB

                                                                                                                                                                                                                                                                                                                                            • memory/4568-126-0x00007FFDE34D0000-0x00007FFDE34DF000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              60KB

                                                                                                                                                                                                                                                                                                                                            • memory/4568-105-0x00007FFDDE050000-0x00007FFDDE074000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                                                                                                            • memory/4568-97-0x00007FFDD9490000-0x00007FFDD98FE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              4.4MB