Overview

overview

10

Static

static

3

Solara.exe

windows7-x64

8

Solara.exe

windows10-2004-x64

10

Resubmissions

12-01-2025 14:35

250112-rx8vssyndp 10

12-01-2025 06:09

250112-gwmwtszmbt 10

Analysis

  • max time kernel
    149s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20241023-en
  • resource tags

    arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
  • submitted
    12-01-2025 06:09

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Solara.exe

  • Size

    13.7MB

  • MD5

    cc6d7a6b17febe201b7f7d26ce944c08

  • SHA1

    231e8439c0facca7cc4b730bf950351d48e3a7c2

  • SHA256

    b1883486b5e6da993af6deb6f4d0f524ccdc6317bdc32ed50dccd1799867a3bd

  • SHA512

    c2abd5a8a59e09951df3d17b591442097cb2615a57abbef9afee9660dcd59ece483ca9a6ab4e83a622235eef4c75ef64dc2b32b58829cef8c485e1517e9ba652

  • SSDEEP

    393216:KsEANEX3gBGYVwwoE0VhUqE7SlO9h4m/a360m:KhIEX3kGN/XBEWs4EA60m

Score
8/10
executionpersistencepyinstallerupx

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 64 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 64 IoCs
  • Adds Run key to start application 2 TTPs 64 IoCs
    persistence
  • UPX packed file 49 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Detects Pyinstaller 1 IoCs
    pyinstaller
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Solara.exe
    "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2592
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2380
    • C:\Users\Admin\AppData\Local\Temp\Solara.exe
      "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
      2⤵
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2504
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1492
      • C:\Users\Admin\AppData\Local\Temp\Solara.exe
        "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
        3⤵
        • Loads dropped DLL
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:600
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2580
        • C:\Users\Admin\AppData\Local\Temp\Solara.exe
          "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
          4⤵
          • Loads dropped DLL
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:928
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1408
          • C:\Users\Admin\AppData\Local\Temp\Solara.exe
            "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
            5⤵
            • Loads dropped DLL
            • Suspicious use of WriteProcessMemory
            PID:2076
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
              6⤵
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:568
            • C:\Users\Admin\AppData\Local\Temp\Solara.exe
              "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
              6⤵
              • Loads dropped DLL
              • Adds Run key to start application
              PID:1424
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                7⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:1700
              • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                7⤵
                • Loads dropped DLL
                • Adds Run key to start application
                PID:2272
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                  8⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1752
                • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                  "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                  8⤵
                  • Loads dropped DLL
                  • Adds Run key to start application
                  PID:2788
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                    9⤵
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:308
                  • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                    "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                    9⤵
                    • Loads dropped DLL
                    • Adds Run key to start application
                    PID:1764
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                      10⤵
                      • Command and Scripting Interpreter: PowerShell
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1140
                    • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                      "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                      10⤵
                      • Loads dropped DLL
                      • Adds Run key to start application
                      PID:1648
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                        11⤵
                        • Command and Scripting Interpreter: PowerShell
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:1200
                      • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                        "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                        11⤵
                        • Loads dropped DLL
                        • Adds Run key to start application
                        PID:2780
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                          12⤵
                          • Command and Scripting Interpreter: PowerShell
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          PID:1064
                        • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                          "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                          12⤵
                          • Loads dropped DLL
                          PID:2036
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                            13⤵
                            • Command and Scripting Interpreter: PowerShell
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            PID:2932
                          • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                            "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                            13⤵
                            • Loads dropped DLL
                            • Adds Run key to start application
                            PID:1400
                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                              14⤵
                              • Command and Scripting Interpreter: PowerShell
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              PID:468
                            • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                              "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                              14⤵
                              • Loads dropped DLL
                              • Adds Run key to start application
                              PID:1816
                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                                15⤵
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of AdjustPrivilegeToken
                                PID:1612
                              • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                                "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                                15⤵
                                • Loads dropped DLL
                                • Adds Run key to start application
                                PID:1296
                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                                  16⤵
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:2708
                                • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                                  "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                                  16⤵
                                  • Loads dropped DLL
                                  • Adds Run key to start application
                                  PID:928
                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                                    17⤵
                                    • Command and Scripting Interpreter: PowerShell
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:2840
                                  • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                                    "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                                    17⤵
                                    • Loads dropped DLL
                                    • Adds Run key to start application
                                    PID:2440
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                                      18⤵
                                      • Command and Scripting Interpreter: PowerShell
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:2236
                                    • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                                      "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                                      18⤵
                                      • Loads dropped DLL
                                      • Adds Run key to start application
                                      PID:2512
                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                                        19⤵
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:1508
                                      • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                                        "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                                        19⤵
                                        • Loads dropped DLL
                                        • Adds Run key to start application
                                        PID:1636
                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                                          20⤵
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:1380
                                        • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                                          "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                                          20⤵
                                          • Loads dropped DLL
                                          PID:1732
                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                                            21⤵
                                            • Command and Scripting Interpreter: PowerShell
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:2712
                                          • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                                            "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                                            21⤵
                                            • Loads dropped DLL
                                            PID:2528
                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                                              22⤵
                                              • Command and Scripting Interpreter: PowerShell
                                              • Suspicious behavior: EnumeratesProcesses
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:2368
                                            • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                                              "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                                              22⤵
                                              • Adds Run key to start application
                                              PID:1616
                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                                                23⤵
                                                • Command and Scripting Interpreter: PowerShell
                                                • Suspicious behavior: EnumeratesProcesses
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:2296
                                              • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                                                "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                                                23⤵
                                                  PID:2448
                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                                                    24⤵
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:572
                                                  • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                                                    24⤵
                                                    • Adds Run key to start application
                                                    PID:1980
                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                                                      25⤵
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:952
                                                    • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                                                      25⤵
                                                        PID:2784
                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                                                          26⤵
                                                          • Command and Scripting Interpreter: PowerShell
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:2316
                                                        • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                                                          26⤵
                                                          • Adds Run key to start application
                                                          PID:3000
                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                                                            27⤵
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:1888
                                                          • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                                                            27⤵
                                                            • Adds Run key to start application
                                                            PID:1840
                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                                                              28⤵
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:2436
                                                            • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                                                              28⤵
                                                                PID:1912
                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                                                                  29⤵
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  PID:2772
                                                                • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                                                                  29⤵
                                                                  • Adds Run key to start application
                                                                  PID:2380
                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                                                                    30⤵
                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    PID:2716
                                                                  • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                                                                    30⤵
                                                                      PID:2196
                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                                                                        31⤵
                                                                        • Command and Scripting Interpreter: PowerShell
                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                        PID:1696
                                                                      • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                                                                        31⤵
                                                                          PID:752
                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                                                                            32⤵
                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            PID:2716
                                                                          • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                                                                            32⤵
                                                                            • Adds Run key to start application
                                                                            PID:2796
                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                                                                              33⤵
                                                                              • Command and Scripting Interpreter: PowerShell
                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                              PID:1332
                                                                            • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                                                                              33⤵
                                                                              • Adds Run key to start application
                                                                              PID:1752
                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                                                                                34⤵
                                                                                  PID:1636
                                                                                • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                                                                                  "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                                                                                  34⤵
                                                                                  • Adds Run key to start application
                                                                                  PID:2028
                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                                                                                    35⤵
                                                                                      PID:2420
                                                                                    • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                                                                                      "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                                                                                      35⤵
                                                                                      • Adds Run key to start application
                                                                                      PID:656
                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                                                                                        36⤵
                                                                                          PID:912
                                                                                        • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                                                                                          "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                                                                                          36⤵
                                                                                          • Adds Run key to start application
                                                                                          PID:2292
                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                                                                                            37⤵
                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                            PID:2188
                                                                                          • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                                                                                            37⤵
                                                                                            • Adds Run key to start application
                                                                                            PID:928
                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                                                                                              38⤵
                                                                                              • Command and Scripting Interpreter: PowerShell
                                                                                              PID:2316
                                                                                            • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                                                                                              "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                                                                                              38⤵
                                                                                              • Adds Run key to start application
                                                                                              PID:448
                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                                                                                                39⤵
                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                PID:1544
                                                                                              • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                                                                                                39⤵
                                                                                                • Adds Run key to start application
                                                                                                PID:1572
                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                                                                                                  40⤵
                                                                                                    PID:2124
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                                                                                                    40⤵
                                                                                                    • Adds Run key to start application
                                                                                                    PID:2200
                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                                                                                                      41⤵
                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                      PID:1348
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                                                                                                      41⤵
                                                                                                      • Adds Run key to start application
                                                                                                      PID:2184
                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                                                                                                        42⤵
                                                                                                        • Command and Scripting Interpreter: PowerShell
                                                                                                        PID:2124
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                                                                                                        42⤵
                                                                                                        • Adds Run key to start application
                                                                                                        PID:2328
                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                                                                                                          43⤵
                                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                                          PID:2448
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                                                                                                          43⤵
                                                                                                          • Adds Run key to start application
                                                                                                          PID:1168
                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                                                                                                            44⤵
                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                            PID:2844
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                                                                                                            44⤵
                                                                                                            • Adds Run key to start application
                                                                                                            PID:944
                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                                                                                                              45⤵
                                                                                                              • Command and Scripting Interpreter: PowerShell
                                                                                                              PID:2376
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                                                                                                              45⤵
                                                                                                              • Adds Run key to start application
                                                                                                              PID:2928
                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                                                                                                                46⤵
                                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                                PID:956
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                                                                                                                46⤵
                                                                                                                • Adds Run key to start application
                                                                                                                PID:324
                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                                                                                                                  47⤵
                                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                                  PID:1064
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                                                                                                                  47⤵
                                                                                                                  • Adds Run key to start application
                                                                                                                  PID:2452
                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                                                                                                                    48⤵
                                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                                    PID:2988
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                                                                                                                    48⤵
                                                                                                                    • Adds Run key to start application
                                                                                                                    PID:1908
                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                                                                                                                      49⤵
                                                                                                                        PID:1212
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                                                                                                                        49⤵
                                                                                                                        • Adds Run key to start application
                                                                                                                        PID:2824
                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                                                                                                                          50⤵
                                                                                                                            PID:1756
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                                                                                                                            50⤵
                                                                                                                            • Adds Run key to start application
                                                                                                                            PID:1656
                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                                                                                                                              51⤵
                                                                                                                                PID:2888
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                                                                                                                                51⤵
                                                                                                                                • Adds Run key to start application
                                                                                                                                PID:1348
                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                                                                                                                                  52⤵
                                                                                                                                    PID:2164
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                                                                                                                                    52⤵
                                                                                                                                    • Adds Run key to start application
                                                                                                                                    PID:3068
                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                                                                                                                                      53⤵
                                                                                                                                        PID:2792
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                                                                                                                                        53⤵
                                                                                                                                        • Adds Run key to start application
                                                                                                                                        PID:1064
                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                                                                                                                                          54⤵
                                                                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                                                                          PID:1140
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                                                                                                                                          54⤵
                                                                                                                                          • Adds Run key to start application
                                                                                                                                          PID:1164
                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                                                                                                                                            55⤵
                                                                                                                                              PID:1576
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                                                                                                                                              55⤵
                                                                                                                                                PID:2828
                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
                                                                                                                                                  56⤵
                                                                                                                                                    PID:2036
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Solara.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
                                                                                                                                                    56⤵
                                                                                                                                                      PID:1876
                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                      56⤵
                                                                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                                                                      PID:1580
                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                    55⤵
                                                                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                                                                    PID:2352
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                    55⤵
                                                                                                                                                      PID:696
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                        56⤵
                                                                                                                                                          PID:2960
                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                      54⤵
                                                                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                                                                      PID:2096
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                      54⤵
                                                                                                                                                        PID:944
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                          55⤵
                                                                                                                                                            PID:1756
                                                                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                        53⤵
                                                                                                                                                        • Command and Scripting Interpreter: PowerShell
                                                                                                                                                        PID:1500
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                        53⤵
                                                                                                                                                          PID:2632
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                            54⤵
                                                                                                                                                              PID:2932
                                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                          52⤵
                                                                                                                                                            PID:1644
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                            52⤵
                                                                                                                                                              PID:2392
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                53⤵
                                                                                                                                                                  PID:336
                                                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                              51⤵
                                                                                                                                                                PID:320
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                51⤵
                                                                                                                                                                  PID:2904
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                    52⤵
                                                                                                                                                                      PID:1212
                                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                  50⤵
                                                                                                                                                                    PID:2932
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                    50⤵
                                                                                                                                                                      PID:2320
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                        51⤵
                                                                                                                                                                          PID:2848
                                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                      49⤵
                                                                                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                      PID:2672
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                      49⤵
                                                                                                                                                                        PID:568
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                          50⤵
                                                                                                                                                                            PID:2452
                                                                                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                        48⤵
                                                                                                                                                                        • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                        PID:1632
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                        48⤵
                                                                                                                                                                          PID:1636
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                            49⤵
                                                                                                                                                                              PID:2216
                                                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                          47⤵
                                                                                                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                          PID:2560
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                          47⤵
                                                                                                                                                                            PID:2488
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                              48⤵
                                                                                                                                                                                PID:348
                                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                            46⤵
                                                                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                            PID:656
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                            46⤵
                                                                                                                                                                              PID:2404
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                47⤵
                                                                                                                                                                                  PID:2772
                                                                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                              45⤵
                                                                                                                                                                                PID:2828
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                45⤵
                                                                                                                                                                                  PID:1796
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                    46⤵
                                                                                                                                                                                      PID:2208
                                                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                                  44⤵
                                                                                                                                                                                    PID:2400
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                    44⤵
                                                                                                                                                                                      PID:840
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                        45⤵
                                                                                                                                                                                          PID:2612
                                                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                                      43⤵
                                                                                                                                                                                        PID:2084
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                        43⤵
                                                                                                                                                                                          PID:928
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                            44⤵
                                                                                                                                                                                              PID:2576
                                                                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                                          42⤵
                                                                                                                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                          PID:2740
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                          42⤵
                                                                                                                                                                                            PID:2272
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                              43⤵
                                                                                                                                                                                                PID:2028
                                                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                                            41⤵
                                                                                                                                                                                              PID:3048
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                              41⤵
                                                                                                                                                                                                PID:2884
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                  42⤵
                                                                                                                                                                                                    PID:756
                                                                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                                                40⤵
                                                                                                                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                PID:2068
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                40⤵
                                                                                                                                                                                                  PID:3040
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                    41⤵
                                                                                                                                                                                                      PID:2256
                                                                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                                                  39⤵
                                                                                                                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                  PID:1636
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                  39⤵
                                                                                                                                                                                                    PID:2832
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                      40⤵
                                                                                                                                                                                                        PID:1764
                                                                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                                                    38⤵
                                                                                                                                                                                                      PID:2208
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                      38⤵
                                                                                                                                                                                                        PID:3060
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                          39⤵
                                                                                                                                                                                                            PID:1088
                                                                                                                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                                                        37⤵
                                                                                                                                                                                                        • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                        PID:2824
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                        37⤵
                                                                                                                                                                                                          PID:1096
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                            38⤵
                                                                                                                                                                                                              PID:2252
                                                                                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                                                          36⤵
                                                                                                                                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                          PID:840
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                          36⤵
                                                                                                                                                                                                            PID:2412
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                              37⤵
                                                                                                                                                                                                                PID:2080
                                                                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                                                            35⤵
                                                                                                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                            PID:1964
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                            35⤵
                                                                                                                                                                                                              PID:2388
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                36⤵
                                                                                                                                                                                                                  PID:2280
                                                                                                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                                                              34⤵
                                                                                                                                                                                                                PID:2180
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                34⤵
                                                                                                                                                                                                                  PID:2380
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                    35⤵
                                                                                                                                                                                                                      PID:1924
                                                                                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                                                                  33⤵
                                                                                                                                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                  PID:2828
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                  33⤵
                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                  PID:2808
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                    34⤵
                                                                                                                                                                                                                      PID:1036
                                                                                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                                                                  32⤵
                                                                                                                                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                  PID:2324
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                  32⤵
                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                  PID:3012
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                    33⤵
                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                    PID:920
                                                                                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                                                                31⤵
                                                                                                                                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                PID:348
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                31⤵
                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                PID:872
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                  32⤵
                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                  PID:2512
                                                                                                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                                                              30⤵
                                                                                                                                                                                                              • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                              PID:2800
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                              30⤵
                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                              PID:2360
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                                31⤵
                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                PID:1312
                                                                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                                                            29⤵
                                                                                                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                            PID:880
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                            29⤵
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            PID:1652
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                              30⤵
                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                              PID:812
                                                                                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                                                          28⤵
                                                                                                                                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                          PID:2352
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                          28⤵
                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                          PID:908
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                            29⤵
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            PID:992
                                                                                                                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                                                        27⤵
                                                                                                                                                                                                        • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                        PID:2828
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                        27⤵
                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                        PID:2248
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                          28⤵
                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                          PID:1288
                                                                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                                                      26⤵
                                                                                                                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                      PID:380
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                      26⤵
                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                      PID:1760
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                        27⤵
                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                        PID:1904
                                                                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                                                    25⤵
                                                                                                                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                    PID:2332
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                    25⤵
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    PID:2040
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                      26⤵
                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                      PID:1988
                                                                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                                                  24⤵
                                                                                                                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                  PID:1544
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                  24⤵
                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                  PID:2192
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                    25⤵
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    PID:1528
                                                                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                                                23⤵
                                                                                                                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                PID:2760
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                23⤵
                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                PID:3032
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                  24⤵
                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                  PID:2504
                                                                                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                                              22⤵
                                                                                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                              PID:3040
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                              22⤵
                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                              • Loads dropped DLL
                                                                                                                                                                                              PID:1936
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                                23⤵
                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                                                PID:1132
                                                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                                            21⤵
                                                                                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                            PID:1588
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                            21⤵
                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                            • Loads dropped DLL
                                                                                                                                                                                            PID:1744
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                              22⤵
                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                              • Loads dropped DLL
                                                                                                                                                                                              PID:1204
                                                                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                                          20⤵
                                                                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                          PID:952
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                          20⤵
                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                          • Loads dropped DLL
                                                                                                                                                                                          PID:2936
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                            21⤵
                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                            • Loads dropped DLL
                                                                                                                                                                                            PID:2064
                                                                                                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                                        19⤵
                                                                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                        PID:2216
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                        19⤵
                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                                                        PID:1828
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                          20⤵
                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                          • Loads dropped DLL
                                                                                                                                                                                          PID:2540
                                                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                                      18⤵
                                                                                                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                      PID:2536
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                      18⤵
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      • Loads dropped DLL
                                                                                                                                                                                      PID:2996
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                        19⤵
                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                                                        PID:1736
                                                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                                    17⤵
                                                                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                    PID:1132
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                    17⤵
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                                                    PID:2868
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                      18⤵
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      • Loads dropped DLL
                                                                                                                                                                                      PID:800
                                                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                                  16⤵
                                                                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                  PID:2720
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                  16⤵
                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                  • Loads dropped DLL
                                                                                                                                                                                  PID:2588
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                    17⤵
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                                                    PID:2736
                                                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                                15⤵
                                                                                                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                PID:1696
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                15⤵
                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                                PID:2240
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                  16⤵
                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                  • Loads dropped DLL
                                                                                                                                                                                  PID:2968
                                                                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                              14⤵
                                                                                                                                                                              • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                              PID:1728
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                              14⤵
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              • Loads dropped DLL
                                                                                                                                                                              PID:2356
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                                15⤵
                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                                PID:1480
                                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                            13⤵
                                                                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                            PID:900
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                            13⤵
                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                            • Loads dropped DLL
                                                                                                                                                                            PID:2680
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                              14⤵
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              • Loads dropped DLL
                                                                                                                                                                              PID:1984
                                                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                          12⤵
                                                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                          PID:3056
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                          12⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          • Loads dropped DLL
                                                                                                                                                                          PID:1876
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                            13⤵
                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                            • Loads dropped DLL
                                                                                                                                                                            PID:2096
                                                                                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                        11⤵
                                                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                        PID:3000
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                        11⤵
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                                        PID:1860
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                          12⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          • Loads dropped DLL
                                                                                                                                                                          PID:2788
                                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                      10⤵
                                                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                      PID:1012
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                      10⤵
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      • Loads dropped DLL
                                                                                                                                                                      PID:1724
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                        11⤵
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                                        PID:2960
                                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                    9⤵
                                                                                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                    PID:1164
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                    9⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                                    PID:2580
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                      10⤵
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      • Loads dropped DLL
                                                                                                                                                                      PID:1552
                                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                  8⤵
                                                                                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                  PID:2732
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                  8⤵
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  • Loads dropped DLL
                                                                                                                                                                  PID:1580
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                    9⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                                    PID:1756
                                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                                7⤵
                                                                                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                PID:2080
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                7⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                PID:1500
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                  8⤵
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  • Loads dropped DLL
                                                                                                                                                                  PID:2560
                                                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                              6⤵
                                                                                                                                                              • Command and Scripting Interpreter: PowerShell
                                                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                              PID:2156
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                              6⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              • Loads dropped DLL
                                                                                                                                                              PID:1972
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                                7⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                PID:1772
                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                            5⤵
                                                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                            PID:2516
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                            5⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            • Loads dropped DLL
                                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                                            PID:2916
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                              6⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              • Loads dropped DLL
                                                                                                                                                              PID:1812
                                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                          4⤵
                                                                                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                          PID:2276
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                          4⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          • Loads dropped DLL
                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                          PID:1940
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                            5⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            • Loads dropped DLL
                                                                                                                                                            PID:3064
                                                                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                        3⤵
                                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                        PID:1916
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                        3⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                                                        PID:324
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                          4⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          • Loads dropped DLL
                                                                                                                                                          PID:2252
                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
                                                                                                                                                      2⤵
                                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                      PID:1608
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                      2⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      • Loads dropped DLL
                                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                                      PID:2248
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
                                                                                                                                                        3⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                        PID:1068
                                                                                                                                                  • C:\Windows\system32\conhost.exe
                                                                                                                                                    \??\C:\Windows\system32\conhost.exe "1006963958277524197457467005-14151111131225082169-19868435831370366955-268552297"
                                                                                                                                                    1⤵
                                                                                                                                                      PID:3000
                                                                                                                                                    • C:\Windows\system32\conhost.exe
                                                                                                                                                      \??\C:\Windows\system32\conhost.exe "989349281-1313388392-9749641-1341288715475477644-8083588941866247843-350002878"
                                                                                                                                                      1⤵
                                                                                                                                                        PID:3056
                                                                                                                                                      • C:\Windows\system32\conhost.exe
                                                                                                                                                        \??\C:\Windows\system32\conhost.exe "-1446537280-2015864663646649569-13313237331918933438-326182490-1755624103-2036538841"
                                                                                                                                                        1⤵
                                                                                                                                                          PID:2840
                                                                                                                                                        • C:\Windows\system32\conhost.exe
                                                                                                                                                          \??\C:\Windows\system32\conhost.exe "-673638157-1970523455-871701831380118447-216895781-286508731977523737-1618400384"
                                                                                                                                                          1⤵
                                                                                                                                                            PID:2828

                                                                                                                                                          Network

                                                                                                                                                          MITRE ATT&CK Enterprise v15

                                                                                                                                                          Replay Monitor

                                                                                                                                                          Loading Replay Monitor...

                                                                                                                                                          Downloads

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Exela.exe
                                                                                                                                                            Filesize

                                                                                                                                                            9.5MB

                                                                                                                                                            MD5

                                                                                                                                                            0615d49be12c174704a3daad945f7b56

                                                                                                                                                            SHA1

                                                                                                                                                            90d67801dcff362ce2c2accafd5010c7f79567d6

                                                                                                                                                            SHA256

                                                                                                                                                            573a7f2fa701a7630318119d9e6d916cb8a0acd87a0a2797b7197e9ae85c0071

                                                                                                                                                            SHA512

                                                                                                                                                            40d702b8fd2993aeeb09755e760d3611d76f927ae6831ab7066386d3a133257e06330ddff2d28406b77c1d9e502e79a7a72b8984ce0d795948da07dd03b9bea9

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI19402\attrs-24.3.0.dist-info\INSTALLER
                                                                                                                                                            Filesize

                                                                                                                                                            4B

                                                                                                                                                            MD5

                                                                                                                                                            365c9bfeb7d89244f2ce01c1de44cb85

                                                                                                                                                            SHA1

                                                                                                                                                            d7a03141d5d6b1e88b6b59ef08b6681df212c599

                                                                                                                                                            SHA256

                                                                                                                                                            ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508

                                                                                                                                                            SHA512

                                                                                                                                                            d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI19722\VCRUNTIME140.dll
                                                                                                                                                            Filesize

                                                                                                                                                            106KB

                                                                                                                                                            MD5

                                                                                                                                                            870fea4e961e2fbd00110d3783e529be

                                                                                                                                                            SHA1

                                                                                                                                                            a948e65c6f73d7da4ffde4e8533c098a00cc7311

                                                                                                                                                            SHA256

                                                                                                                                                            76fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644

                                                                                                                                                            SHA512

                                                                                                                                                            0b636a3cdefa343eb4cb228b391bb657b5b4c20df62889cd1be44c7bee94ffad6ec82dc4db79949edef576bff57867e0d084e0a597bf7bf5c8e4ed1268477e88

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI19722\_asyncio.pyd
                                                                                                                                                            Filesize

                                                                                                                                                            34KB

                                                                                                                                                            MD5

                                                                                                                                                            7d4f9a2b793e021f7e37b8448751ed4e

                                                                                                                                                            SHA1

                                                                                                                                                            0ea07b5024501aad5008655cfeae6d96b5da957a

                                                                                                                                                            SHA256

                                                                                                                                                            2293c1b6b0b901832a57a1c4dcb1265c9e92d21177195712c30632a7b63227d4

                                                                                                                                                            SHA512

                                                                                                                                                            af75452279c308c61c3e222a031a8201e47e8fe44c4e92cb7dab03d56c7e7e3e2a2c589f650c50e0b29e2df175d6f2ff50c8e5e589d17a124bf0a2e0d7886c26

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI19722\_bz2.pyd
                                                                                                                                                            Filesize

                                                                                                                                                            46KB

                                                                                                                                                            MD5

                                                                                                                                                            6250a28b9d0bfefc1254bd78ece7ae9f

                                                                                                                                                            SHA1

                                                                                                                                                            4b07c8e18d23c8ae9d92d7b8d39ae20bc447aecd

                                                                                                                                                            SHA256

                                                                                                                                                            7d43f7105aa4f856239235c67f61044493ee6f95ddf04533189bf5ea98073f0b

                                                                                                                                                            SHA512

                                                                                                                                                            6d0aa5c3f8f5b268b94341dfdd5afbe48f91f9aac143bf59f7f5e8ba6f54205b85ec527c53498ed8860fdff6a8d08e48ec4e1652eeab2d3c89aaaf3a14fcaaa7

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI19722\_cffi_backend.cp310-win_amd64.pyd
                                                                                                                                                            Filesize

                                                                                                                                                            71KB

                                                                                                                                                            MD5

                                                                                                                                                            7727212e7bdbf63b1a39fb7faad24265

                                                                                                                                                            SHA1

                                                                                                                                                            a8fdec19d6690081b2bf55247e8e17657a68ac97

                                                                                                                                                            SHA256

                                                                                                                                                            b0116303e1e903d6eb02a69d05879f38af1640813f4b110cb733ffff6e4e985c

                                                                                                                                                            SHA512

                                                                                                                                                            2b1a27642118dd228791d0d8ba307aa39ab2d9c7d3799cff9f3c0744fe270eeaefe5545a4fda6e74e86fee747e45bf5f6c9ac799950c2b483a16eb3ce85d816a

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI19722\_ctypes.pyd
                                                                                                                                                            Filesize

                                                                                                                                                            56KB

                                                                                                                                                            MD5

                                                                                                                                                            4b90108fabdd64577a84313c765a2946

                                                                                                                                                            SHA1

                                                                                                                                                            245f4628683a3e18bb6f0d1c88aa26fb959ed258

                                                                                                                                                            SHA256

                                                                                                                                                            e1b634628839a45ab08913463e07b6b6b7fd502396d768f43b21da2875b506a1

                                                                                                                                                            SHA512

                                                                                                                                                            91fa069d7cf61c57faad6355f6fd46d702576c4342460dadcedfdcbc07cd9d84486734f0561fa5e1e01668b384c3c07dd779b332f77d0bb6fbdbb8c0cb5091bc

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI19722\_decimal.pyd
                                                                                                                                                            Filesize

                                                                                                                                                            103KB

                                                                                                                                                            MD5

                                                                                                                                                            20985dc78dbd1992382354af5ca28988

                                                                                                                                                            SHA1

                                                                                                                                                            385a3e7a7654e5e4c686399f3a72b235e941e311

                                                                                                                                                            SHA256

                                                                                                                                                            f3620cac68595b8a8495ab044f19a1c89012f50d2fe571b7a1721485f7ff2e43

                                                                                                                                                            SHA512

                                                                                                                                                            61b8ecd2d12b3f785773b98d4bf4af0eb6eb2c61fbea6effb77ec24b2127e888d0ea5fdd8cc298484e0f770d70c87907048fc382faace8e0ca6b49ab106c89f8

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI19722\_hashlib.pyd
                                                                                                                                                            Filesize

                                                                                                                                                            33KB

                                                                                                                                                            MD5

                                                                                                                                                            3b5530f497ff7c127383d0029e680c35

                                                                                                                                                            SHA1

                                                                                                                                                            fb5dc554bb9ff49622184cc16883a7567115c7ca

                                                                                                                                                            SHA256

                                                                                                                                                            5971fcc9758b7f4a12cde2190a323f35a34ab7f97bd8c39cc8f3335223102573

                                                                                                                                                            SHA512

                                                                                                                                                            12ced7ddb0352f8eca3c3cb7c7c2faaf08e617b2dd278d20008051fb6b564b17c3e9ecfa8b0ffe7674154ad533dfbbf1e802accd5e1aef12ece01368da06e85a

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI19722\_lzma.pyd
                                                                                                                                                            Filesize

                                                                                                                                                            84KB

                                                                                                                                                            MD5

                                                                                                                                                            8edbeeccb6f3dbb09389d99d45db5542

                                                                                                                                                            SHA1

                                                                                                                                                            f7e7af2851a5bf22de79a24fe594b5c0435fca8a

                                                                                                                                                            SHA256

                                                                                                                                                            90701973be6b23703e495f6a145bae251a7bb066d3c5f398ec42694fd06a069f

                                                                                                                                                            SHA512

                                                                                                                                                            2a8bf60f2280b9a947578bd7fd49c3ace8e010a3d4b38e370edb511ea0e125df688bbac369d6a3cec9d285a1fa2ad2dac18a0ef30fda46e49a9440418581e501

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI19722\_multiprocessing.pyd
                                                                                                                                                            Filesize

                                                                                                                                                            25KB

                                                                                                                                                            MD5

                                                                                                                                                            4fbc5fd5da9da74c04fe0374387b34d3

                                                                                                                                                            SHA1

                                                                                                                                                            1e9c98db0486f98fb7d8eb9fa57a949494b649b5

                                                                                                                                                            SHA256

                                                                                                                                                            b2347790c87052623710382d3178887f68a79618d6da5174909f46b169236950

                                                                                                                                                            SHA512

                                                                                                                                                            ce87d4512c2ab7c1ad7986e8e1fe790615ae39c7667d234dfc09026ee7e1518b3bfbf7974612811db0c3e5654b35b54e118e23e624bebe027a51d2c8f2a4652a

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI19722\_overlapped.pyd
                                                                                                                                                            Filesize

                                                                                                                                                            30KB

                                                                                                                                                            MD5

                                                                                                                                                            5c1441f6ee11632183a83dac2d22853b

                                                                                                                                                            SHA1

                                                                                                                                                            eef732ff4bab9ea5c8fffb6a93c47cfc8e64dae2

                                                                                                                                                            SHA256

                                                                                                                                                            104e0b0e0e9fec9eb6438683296feeba298d5f23b02d2080577fc87ffec67acf

                                                                                                                                                            SHA512

                                                                                                                                                            e41d3433754a8a3d2c572bb7f3902c0d37cba2e6f3307f0e6dfed316a22b11ef7e52a73c30085fa89fcff603e4b76858abe761217c320e38fa2eb95d1777b595

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI19722\_queue.pyd
                                                                                                                                                            Filesize

                                                                                                                                                            24KB

                                                                                                                                                            MD5

                                                                                                                                                            5c4c43763fb1a796134aa5734905c891

                                                                                                                                                            SHA1

                                                                                                                                                            44a5e1ae4806406a239129d77888bd87d291a410

                                                                                                                                                            SHA256

                                                                                                                                                            4edc80e7d331ba0e9338431d407157181190f995821d1cd24f7a7aa2422ece0c

                                                                                                                                                            SHA512

                                                                                                                                                            07bec7e4a85e76cfab2c21776b50ee2bd0454835fcb43b573dee757eca24cbeb4530784bae07de3be90820cee6d72023d9ded395d4f1a4931971db247dc1a71e

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI19722\_socket.pyd
                                                                                                                                                            Filesize

                                                                                                                                                            41KB

                                                                                                                                                            MD5

                                                                                                                                                            53e72716073038c1dd1db65bfdb1254c

                                                                                                                                                            SHA1

                                                                                                                                                            7bf220a02a3b51aa51300b3a9ea7fa48358ca161

                                                                                                                                                            SHA256

                                                                                                                                                            e1fb6927ba2ed014d0ac750af0ee0bb3d49487dd6920848937259606e1e92e1d

                                                                                                                                                            SHA512

                                                                                                                                                            c10d91b6ec82402b0eb05dc31a4703c999f4988e88204b695e009fae5fdcc61e8a6dc4d2879ecf2babc030224048afd2f256b9e7f5c5b6f28762047813be0941

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI19722\_sqlite3.pyd
                                                                                                                                                            Filesize

                                                                                                                                                            48KB

                                                                                                                                                            MD5

                                                                                                                                                            e7d68df8f65fbb0298a45519e2336f32

                                                                                                                                                            SHA1

                                                                                                                                                            ad3c84ad7eb75a61f287b1ba9fd2801567e39b6d

                                                                                                                                                            SHA256

                                                                                                                                                            2473ebaf52723c3751a12117ebbe974e50ecdaeb40b282a12ba4e6aa98492e79

                                                                                                                                                            SHA512

                                                                                                                                                            626204685e9b95310aba51be4a8abaf3b6e152fa35902f64f837303fc4011a4518ee393047ceb45bf377e9d965d169c92bfbb6673475150e159c59b7857ba03e

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI19722\_ssl.pyd
                                                                                                                                                            Filesize

                                                                                                                                                            60KB

                                                                                                                                                            MD5

                                                                                                                                                            7e9d95ac47a2284706318656b4f711d3

                                                                                                                                                            SHA1

                                                                                                                                                            f085104709201c6e64635aeacf1da51599054e55

                                                                                                                                                            SHA256

                                                                                                                                                            38dcb3d0f217785b39c03d4c949dd1e04b70e9eade8a4ad83f026390684059c9

                                                                                                                                                            SHA512

                                                                                                                                                            294a5148d8fcddabd177b776617da7720d9876ac2a1cdf8dd7b9489f0f719600a634346cdfa07da66588de885b0a64d8cccde4d47edbf6305bd2af44ee209118

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI19722\_uuid.pyd
                                                                                                                                                            Filesize

                                                                                                                                                            21KB

                                                                                                                                                            MD5

                                                                                                                                                            59cfd9669367517b384922b2485cb6a7

                                                                                                                                                            SHA1

                                                                                                                                                            1bd44298543204d61d4efd2cd3980ad01071360d

                                                                                                                                                            SHA256

                                                                                                                                                            e02bfad84786560b624efd56df55c88a4ffbd6c7cfc728bf68b6401aa10f849f

                                                                                                                                                            SHA512

                                                                                                                                                            d0dd041d8493c7c19db01ea8477981148726796ce2ab58d3193064123319bd5b68fd57871d1db0aaa08d07f78ab96a3d343051c33ffd406e96b921248ea32665

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI19722\aiohttp\_http_parser.cp310-win_amd64.pyd
                                                                                                                                                            Filesize

                                                                                                                                                            81KB

                                                                                                                                                            MD5

                                                                                                                                                            23df1d1a4bfd29c6c0f89d1a42bbecbb

                                                                                                                                                            SHA1

                                                                                                                                                            b8e5686724223bd5e8ed0b7a3517cdc3005be66a

                                                                                                                                                            SHA256

                                                                                                                                                            10f7967a3c574caea10fd5a94c9b6eba405ed6afec402969424c143566593adc

                                                                                                                                                            SHA512

                                                                                                                                                            75a455a9eb96bd52f0d795188a1120ee14d36944c331d97b4c3da837238bd2928cff29df27c0f17093022d976c0c2e54189babd94c6dc927ac325216c340481a

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI19722\aiohttp\_http_writer.cp310-win_amd64.pyd
                                                                                                                                                            Filesize

                                                                                                                                                            24KB

                                                                                                                                                            MD5

                                                                                                                                                            b0e8cbf64f3728eee12e6e0756e67c95

                                                                                                                                                            SHA1

                                                                                                                                                            71bc5ae8847dac5d0737e6321833a37da655d538

                                                                                                                                                            SHA256

                                                                                                                                                            7a931c3108173c4d8cc4ed7304414fcd3ba67ceff81f84506dcdda8979f5f33b

                                                                                                                                                            SHA512

                                                                                                                                                            622126f5a1fc5e275680bb64648a8cac6a5eaf3e7d6a262f0002afc26cec6d9c3addbba257626ac54189b7f85e5abdfc3809954ce0437046fc64b643a4e8cb5a

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI19722\aiohttp\_websocket\mask.cp310-win_amd64.pyd
                                                                                                                                                            Filesize

                                                                                                                                                            19KB

                                                                                                                                                            MD5

                                                                                                                                                            2b5d378afb9aeb031ed1a84f5c216291

                                                                                                                                                            SHA1

                                                                                                                                                            7955e2ec7e7ffa13e58af098d37c480c8f23ccad

                                                                                                                                                            SHA256

                                                                                                                                                            1d44b957609599fdf3115bb47bd668f560b63d4d84c74c1f7bf1f3dc05246d6a

                                                                                                                                                            SHA512

                                                                                                                                                            9102a95c57024afddb67b6500ce1606a2bf5923aa66f67e21fec23c1efb1c9a0cd77c55417b25c7cdbcda119cd817ea4219a1fe321a2f9300f8bffa99d8b0a31

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI19722\aiohttp\_websocket\reader_c.cp310-win_amd64.pyd
                                                                                                                                                            Filesize

                                                                                                                                                            61KB

                                                                                                                                                            MD5

                                                                                                                                                            2cb730463ee9a2360b568bb54ff283b1

                                                                                                                                                            SHA1

                                                                                                                                                            e63b5d62d281f153ab2c3487f4423bec259e1bd5

                                                                                                                                                            SHA256

                                                                                                                                                            17b026c18dc25b2f8842da41484e39c8e92bd3ff9fe0f6d03f9fdc389991e7ae

                                                                                                                                                            SHA512

                                                                                                                                                            a7891ba2619cc6910c47ffac153ba31a3b17f67f08654f7a1fed380b1f4951673573f5e5a59e45e4edc432b135dbb57bb82c3b4cbdfc265d0daa6fca587ab732

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI19722\attrs-24.3.0.dist-info\METADATA
                                                                                                                                                            Filesize

                                                                                                                                                            11KB

                                                                                                                                                            MD5

                                                                                                                                                            0e682e7854fe836cad441326ab36d36d

                                                                                                                                                            SHA1

                                                                                                                                                            3efad7961f8f2dfb0a22a1eeabd3a92b9da0ab23

                                                                                                                                                            SHA256

                                                                                                                                                            7fd8611027805324bb89ec073d1b8c2c3cb5b6927abf2cbc47f4ca5270a6880f

                                                                                                                                                            SHA512

                                                                                                                                                            54fd3b0c98dce7c11691d08ca22c9c8a74cd838d03723dda3fbac326efc2550edb892f9d45aa3956c9c5c35b8c20fe096f6a002dee07150b437a1e7e76ac175a

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI19722\attrs-24.3.0.dist-info\RECORD
                                                                                                                                                            Filesize

                                                                                                                                                            3KB

                                                                                                                                                            MD5

                                                                                                                                                            72c9f466183f7eae813f25ed47198941

                                                                                                                                                            SHA1

                                                                                                                                                            7498fae0d90f7f64d6c954849225e82c8f1bac92

                                                                                                                                                            SHA256

                                                                                                                                                            a237de627ee31b429fed81bdff4fa5b5b22bc979a2580e1205acaedc78761143

                                                                                                                                                            SHA512

                                                                                                                                                            6ed2a1293fa6e27ca3bdaa95af38e3b2299d1d77b7e0fb2d67552cd8f3acaee5be94d4f3f562e6bc42e6f6c7fc9d302c7bd5b14a1243ef86979e077242173c35

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI19722\attrs-24.3.0.dist-info\WHEEL
                                                                                                                                                            Filesize

                                                                                                                                                            87B

                                                                                                                                                            MD5

                                                                                                                                                            e2fcb0ad9ea59332c808928b4b439e7a

                                                                                                                                                            SHA1

                                                                                                                                                            07311208d4849f821e8af25a89a9985c4503fbd8

                                                                                                                                                            SHA256

                                                                                                                                                            aad0b0a12256807936d52d4a6f88a1773236ae527564a688bab4e3fe780e8724

                                                                                                                                                            SHA512

                                                                                                                                                            d4cb3ca64d69678959c4f59b4d1cb992e8e2e046a6acb92341fd30b8ce862bd81a48cbfa09ec9ae2e735ffec5c12d246d1593a859615adee10984635a9ba8af9

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI19722\attrs-24.3.0.dist-info\licenses\LICENSE
                                                                                                                                                            Filesize

                                                                                                                                                            1KB

                                                                                                                                                            MD5

                                                                                                                                                            5e55731824cf9205cfabeab9a0600887

                                                                                                                                                            SHA1

                                                                                                                                                            243e9dd038d3d68c67d42c0c4ba80622c2a56246

                                                                                                                                                            SHA256

                                                                                                                                                            882115c95dfc2af1eeb6714f8ec6d5cbcabf667caff8729f42420da63f714e9f

                                                                                                                                                            SHA512

                                                                                                                                                            21b242bf6dcbafa16336d77a40e69685d7e64a43cc30e13e484c72a93cd4496a7276e18137dc601b6a8c3c193cb775db89853ecc6d6eb2956deee36826d5ebfe

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI19722\base_library.zip
                                                                                                                                                            Filesize

                                                                                                                                                            859KB

                                                                                                                                                            MD5

                                                                                                                                                            9b62388394601020bd24fa9e7b4e9e0a

                                                                                                                                                            SHA1

                                                                                                                                                            06023daf857014770ff38d4ebbd600ba03109f28

                                                                                                                                                            SHA256

                                                                                                                                                            a6993db44fde43c8fdbf3512db50060812924c95f6f60aeb80913380a0b4f3e1

                                                                                                                                                            SHA512

                                                                                                                                                            ac1bfebb36d844a0c5909b34fc1100ff2d1f88a0b71a75aa27b4d2b281a90dcb05259b874e4fdb300572a0c029db96e507b5caefdaf03cc32050dc2b728c654b

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI19722\cryptography-44.0.0.dist-info\METADATA
                                                                                                                                                            Filesize

                                                                                                                                                            5KB

                                                                                                                                                            MD5

                                                                                                                                                            526d9ac9d8150602ec9ed8b9f4de7102

                                                                                                                                                            SHA1

                                                                                                                                                            dba2cb32c21c4b0f575e77bbcdd4fa468056f5e3

                                                                                                                                                            SHA256

                                                                                                                                                            d95f491ed418dc302db03804daf9335ce21b2df4704587e6851ef03e1f84d895

                                                                                                                                                            SHA512

                                                                                                                                                            fb13a2f6b64cb7e380a69424d484fc9b8758fa316a7a155ff062bfdacdca8f2c5d2a03898cd099688b1c16a5a0edcecfc42bf0d4d330926b10c3fce9f5238643

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI19722\cryptography-44.0.0.dist-info\RECORD
                                                                                                                                                            Filesize

                                                                                                                                                            15KB

                                                                                                                                                            MD5

                                                                                                                                                            f15ef7175220c9f59f90bbbaeda16dbd

                                                                                                                                                            SHA1

                                                                                                                                                            5367cac8814d7a54e1c0274ff3f651ed5c6fe5d6

                                                                                                                                                            SHA256

                                                                                                                                                            04db3839c853d4164576122b7d5a2bab186536dc8f9a4980385e11cf59946114

                                                                                                                                                            SHA512

                                                                                                                                                            bb0fa967e03d98b9611006df2155bd8ad58a0e8b1a679d636b94ce931d316f18b61b801e018deca90d8e5a35fa744ae8c9e1a36f25c791052008c43af53a8117

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI19722\cryptography-44.0.0.dist-info\WHEEL
                                                                                                                                                            Filesize

                                                                                                                                                            94B

                                                                                                                                                            MD5

                                                                                                                                                            a868f93fcf51c4f1c25658d54f994349

                                                                                                                                                            SHA1

                                                                                                                                                            535c88a10911673deabb7889d365e81729e483a6

                                                                                                                                                            SHA256

                                                                                                                                                            1e7f5bcad669386a11e8ce14e715131c2d402693c3f41d713eb338493c658c45

                                                                                                                                                            SHA512

                                                                                                                                                            ec13cac9df03676640ef5da033e8c2faee63916f27cc27b9c43f0824b98ab4a6ecb4c8d7d039fa6674ef189bdd9265c8ed509c1d80dff610aeb9e081093aeb3d

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI19722\cryptography-44.0.0.dist-info\licenses\LICENSE
                                                                                                                                                            Filesize

                                                                                                                                                            197B

                                                                                                                                                            MD5

                                                                                                                                                            8c3617db4fb6fae01f1d253ab91511e4

                                                                                                                                                            SHA1

                                                                                                                                                            e442040c26cd76d1b946822caf29011a51f75d6d

                                                                                                                                                            SHA256

                                                                                                                                                            3e0c7c091a948b82533ba98fd7cbb40432d6f1a9acbf85f5922d2f99a93ae6bb

                                                                                                                                                            SHA512

                                                                                                                                                            77a1919e380730bcce5b55d76fbffba2f95874254fad955bd2fe1de7fc0e4e25b5fdaab0feffd6f230fa5dc895f593cf8bfedf8fdc113efbd8e22fadab0b8998

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI19722\cryptography-44.0.0.dist-info\licenses\LICENSE.APACHE
                                                                                                                                                            Filesize

                                                                                                                                                            11KB

                                                                                                                                                            MD5

                                                                                                                                                            4e168cce331e5c827d4c2b68a6200e1b

                                                                                                                                                            SHA1

                                                                                                                                                            de33ead2bee64352544ce0aa9e410c0c44fdf7d9

                                                                                                                                                            SHA256

                                                                                                                                                            aac73b3148f6d1d7111dbca32099f68d26c644c6813ae1e4f05f6579aa2663fe

                                                                                                                                                            SHA512

                                                                                                                                                            f451048e81a49fbfa11b49de16ff46c52a8e3042d1bcc3a50aaf7712b097bed9ae9aed9149c21476c2a1e12f1583d4810a6d36569e993fe1ad3879942e5b0d52

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI19722\cryptography-44.0.0.dist-info\licenses\LICENSE.BSD
                                                                                                                                                            Filesize

                                                                                                                                                            1KB

                                                                                                                                                            MD5

                                                                                                                                                            5ae30ba4123bc4f2fa49aa0b0dce887b

                                                                                                                                                            SHA1

                                                                                                                                                            ea5b412c09f3b29ba1d81a61b878c5c16ffe69d8

                                                                                                                                                            SHA256

                                                                                                                                                            602c4c7482de6479dd2e9793cda275e5e63d773dacd1eca689232ab7008fb4fb

                                                                                                                                                            SHA512

                                                                                                                                                            ddbb20c80adbc8f4118c10d3e116a5cd6536f72077c5916d87258e155be561b89eb45c6341a1e856ec308b49a4cb4dba1408eabd6a781fbe18d6c71c32b72c41

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI19722\cryptography\hazmat\bindings\_rust.pyd
                                                                                                                                                            Filesize

                                                                                                                                                            2.0MB

                                                                                                                                                            MD5

                                                                                                                                                            606a84af5a9cf8ad3cb0314e77fb7209

                                                                                                                                                            SHA1

                                                                                                                                                            6de88d8554488ffe3e48c9b14886da16d1703a69

                                                                                                                                                            SHA256

                                                                                                                                                            0693ffa4990fa8c1664485f3d2a41b581eac0b340d07d62242052a67bf2ed5c3

                                                                                                                                                            SHA512

                                                                                                                                                            97d451f025aefb487c5cea568eb430356adfe23908321f1c04f8fa4c03df87507eda8d9612c944be4fa733df4cec38a0e37bffd8865088064b749244d4321b1f

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI19722\frozenlist\_frozenlist.cp310-win_amd64.pyd
                                                                                                                                                            Filesize

                                                                                                                                                            36KB

                                                                                                                                                            MD5

                                                                                                                                                            219ad30aea7630a3696df28231405927

                                                                                                                                                            SHA1

                                                                                                                                                            ebaf69903305ea0803570cc2ff4cf43dd2bc812a

                                                                                                                                                            SHA256

                                                                                                                                                            06d38127de4cbd3243f861ea22897d490520e913f77011a37d915c4992433604

                                                                                                                                                            SHA512

                                                                                                                                                            72eb7323deb26931ea000690f85272ee71e19b2896af2b43ccd8bcfc3a299e0f8a7a3f1e339fbfe7c855e081cd94e21ae09ba3b8e2d16dbacddb838c31b4de13

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI19722\libcrypto-1_1.dll
                                                                                                                                                            Filesize

                                                                                                                                                            1.1MB

                                                                                                                                                            MD5

                                                                                                                                                            86cfc84f8407ab1be6cc64a9702882ef

                                                                                                                                                            SHA1

                                                                                                                                                            86f3c502ed64df2a5e10b085103c2ffc9e3a4130

                                                                                                                                                            SHA256

                                                                                                                                                            11b89cc5531b2a6b89fbbb406ebe8fb01f0bf789e672131b0354e10f9e091307

                                                                                                                                                            SHA512

                                                                                                                                                            b33f59497127cb1b4c1781693380576187c562563a9e367ce8abc14c97c51053a28af559cdd8bd66181012083e562c8a8771e3d46adeba269a848153a8e9173c

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI19722\libffi-7.dll
                                                                                                                                                            Filesize

                                                                                                                                                            23KB

                                                                                                                                                            MD5

                                                                                                                                                            d50ebf567149ead9d88933561cb87d09

                                                                                                                                                            SHA1

                                                                                                                                                            171df40e4187ebbfdf9aa1d76a33f769fb8a35ed

                                                                                                                                                            SHA256

                                                                                                                                                            6aa8e12ce7c8ad52dd2e3fabeb38a726447849669c084ea63d8e322a193033af

                                                                                                                                                            SHA512

                                                                                                                                                            7bcc9d6d3a097333e1e4b2b23c81ea1b5db7dbdc5d9d62ebaffb0fdfb6cfe86161520ac14dc835d1939be22b9f342531f48da70f765a60b8e2c3d7b9983021de

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI19722\libssl-1_1.dll
                                                                                                                                                            Filesize

                                                                                                                                                            203KB

                                                                                                                                                            MD5

                                                                                                                                                            6cd33578bc5629930329ca3303f0fae1

                                                                                                                                                            SHA1

                                                                                                                                                            f2f8e3248a72f98d27f0cfa0010e32175a18487f

                                                                                                                                                            SHA256

                                                                                                                                                            4150ee603ad2da7a6cb6a895cb5bd928e3a99af7e73c604de1fc224e0809fdb0

                                                                                                                                                            SHA512

                                                                                                                                                            c236a6ccc8577c85509d378c1ef014621cab6f6f4aa26796ff32d8eec8e98ded2e55d358a7d236594f7a48646dc2a6bf25b42a37aed549440d52873ebca4713e

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI19722\multidict\_multidict.cp310-win_amd64.pyd
                                                                                                                                                            Filesize

                                                                                                                                                            20KB

                                                                                                                                                            MD5

                                                                                                                                                            7f691747ce66d3ed05a7c2c53220c8b5

                                                                                                                                                            SHA1

                                                                                                                                                            1d3f247042030cf8cf7c859002941beba5d15776

                                                                                                                                                            SHA256

                                                                                                                                                            7d6472a0d7f1a0740c7fc0d0d0ea6f7c6e7cb2b11b8c623c46a6fae1adb4e228

                                                                                                                                                            SHA512

                                                                                                                                                            b01f0e91039fc5b2782caaa0b3d56d5d1fe9e94424cc536cde9eca73a76747736060042e345af9edc5ef5bf5c154705d2c2dddf35536f305306be25a955a9f06

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI19722\propcache\_helpers_c.cp310-win_amd64.pyd
                                                                                                                                                            Filesize

                                                                                                                                                            31KB

                                                                                                                                                            MD5

                                                                                                                                                            9fe92acae9522cd0044146e1b57c23fa

                                                                                                                                                            SHA1

                                                                                                                                                            ec8875039a387bb4ac302cd533b2fe27dbe75b43

                                                                                                                                                            SHA256

                                                                                                                                                            622077d084db60b50c43a1923d60c02f1900fffa3b5a11dfd34328e6fd341362

                                                                                                                                                            SHA512

                                                                                                                                                            cdf5dae191f9b6c75d5698d49d1a55a00695ac896a0823357ea7bf3332683231cb10b1544ec12fab5cf5a15117a92af18e1266f29ed3d3ccbcb56ff46a421e88

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI19722\pyexpat.pyd
                                                                                                                                                            Filesize

                                                                                                                                                            86KB

                                                                                                                                                            MD5

                                                                                                                                                            46331749084f98bcfe8631d74c5e038f

                                                                                                                                                            SHA1

                                                                                                                                                            5e5510f7a4d03f10d979e0d6a0d2a6f0e53ca347

                                                                                                                                                            SHA256

                                                                                                                                                            21cc4b9ccd69d08d7c1068b1f004ae9454f7ea0a322801860faf0e6f4a24a3df

                                                                                                                                                            SHA512

                                                                                                                                                            edd39ce2d927fb6700a86db07f4f56cab897ef91a320f3e5ecb542ea1be6888dd27a08008e5fa1df3765b0c82d1046a23c8d59e76d11f4e6449d4d6826879589

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI19722\python3.dll
                                                                                                                                                            Filesize

                                                                                                                                                            63KB

                                                                                                                                                            MD5

                                                                                                                                                            c17b7a4b853827f538576f4c3521c653

                                                                                                                                                            SHA1

                                                                                                                                                            6115047d02fbbad4ff32afb4ebd439f5d529485a

                                                                                                                                                            SHA256

                                                                                                                                                            d21e60f3dfbf2bab0cc8a06656721fa3347f026df10297674fc635ebf9559a68

                                                                                                                                                            SHA512

                                                                                                                                                            8e08e702d69df6840781d174c4565e14a28022b40f650fda88d60172be2d4ffd96a3e9426d20718c54072ca0da27e0455cc0394c098b75e062a27559234a3df7

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI19722\select.pyd
                                                                                                                                                            Filesize

                                                                                                                                                            24KB

                                                                                                                                                            MD5

                                                                                                                                                            3797a47a60b606e25348c67043874fe8

                                                                                                                                                            SHA1

                                                                                                                                                            63a33fedffd52190236a6acd0fc5d9d491e3ac45

                                                                                                                                                            SHA256

                                                                                                                                                            312e9b01d1632840983e8533d1685a64fb87e4538f724a7a59a71b1ba148bbac

                                                                                                                                                            SHA512

                                                                                                                                                            3eb7599825b7b21aaab05e420dd16d4a8eaa21652d232f6e4ede213a232b701401556e44df73cfa20ae855d1adc28304b52d42367b74ebd8e96c2e3d9a9b93e2

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI19722\sqlite3.dll
                                                                                                                                                            Filesize

                                                                                                                                                            608KB

                                                                                                                                                            MD5

                                                                                                                                                            6a3a34c9c67efd6c17d44292e8db8fad

                                                                                                                                                            SHA1

                                                                                                                                                            339b1e514d60d8370eaec1e2f2b71cead999f970

                                                                                                                                                            SHA256

                                                                                                                                                            7b0e840165d65f0f5285476467e4c154c4d936613966b84948110a4614b9cad9

                                                                                                                                                            SHA512

                                                                                                                                                            6f2a1b670d28762745f0d3b961a331cbbb0dec244f8798734b911b3a3bc9519c73a3b26f1e1117725f6f1e880e57cadb562a1450659bca1aae353f6b9575d7f5

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI19722\unicodedata.pyd
                                                                                                                                                            Filesize

                                                                                                                                                            287KB

                                                                                                                                                            MD5

                                                                                                                                                            fed35db31377d515d198e5e446498be2

                                                                                                                                                            SHA1

                                                                                                                                                            62e388d17e17208ea0e881ccd96c75b7b1fbc5f7

                                                                                                                                                            SHA256

                                                                                                                                                            af3cdc9a2a1d923be67244429867a3c5c70835249e3573a03b98d08d148fe24b

                                                                                                                                                            SHA512

                                                                                                                                                            0985528cb0289086ec895e21a8947e04f732d5660460f2e7fa8668bd441c891438781c808bcea9294f348720e3752c10ea65363371f7e75ea48600d016bab72a

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI19722\yarl\_quoting_c.cp310-win_amd64.pyd
                                                                                                                                                            Filesize

                                                                                                                                                            41KB

                                                                                                                                                            MD5

                                                                                                                                                            8640834733897205d9193e1b21084135

                                                                                                                                                            SHA1

                                                                                                                                                            e452ae2dbabcc8691233428dd1da5d23961b047d

                                                                                                                                                            SHA256

                                                                                                                                                            bd209ab04ba8a3a40546832380547a460b1257f4fb4b4012f6fc48f9c36cc476

                                                                                                                                                            SHA512

                                                                                                                                                            365805a31ed3ef7648fa2fac49fecc0646dd5dfcad8468918623d962db6aab08339f510edccdaf1340f8bfc06a4628c070de947cdec55cfabdc3563af2de43e7

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI22482\python310.dll
                                                                                                                                                            Filesize

                                                                                                                                                            1.4MB

                                                                                                                                                            MD5

                                                                                                                                                            fc7bd515b12e537a39dc93a09b3eaad6

                                                                                                                                                            SHA1

                                                                                                                                                            96f5d4b0967372553cb106539c5566bc184f6167

                                                                                                                                                            SHA256

                                                                                                                                                            461e008b7cdf034f99a566671b87849772873a175aefec6ed00732976f5c4164

                                                                                                                                                            SHA512

                                                                                                                                                            a8433d5b403f898e4eeebd72fce08ebad066ca60aeb0b70e2ae78377babc2acbbae2ac91ab20f813cce4b1dc58c2ad6b3868f18cc8ac0fe7be2bff020eb73122

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
                                                                                                                                                            Filesize

                                                                                                                                                            7KB

                                                                                                                                                            MD5

                                                                                                                                                            7e7800d7957928638615be4d68c51672

                                                                                                                                                            SHA1

                                                                                                                                                            0745901c339880843053d8764159fe0237733953

                                                                                                                                                            SHA256

                                                                                                                                                            a45bcb60d633a71f1bc2791a74873e5363764e750f516938979cc64baa45e3c4

                                                                                                                                                            SHA512

                                                                                                                                                            86037b7f1edd7cabe1bfef399e1fb78d60672fbdf7e724b4337a3463faa1061a313802a7b88f4d4e88581baa50614f5246845795db198ce58d7047667445b727

                                                                                                                                                            Download Submit

                                                                                                                                                          • memory/800-1098-0x000007FEEDAC0000-0x000007FEEDF2E000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            4.4MB

                                                                                                                                                            Download

                                                                                                                                                          • memory/1068-72-0x000007FEF3AB0000-0x000007FEF3F1E000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            4.4MB

                                                                                                                                                            Download

                                                                                                                                                          • memory/1204-1374-0x000007FEECD70000-0x000007FEED1DE000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            4.4MB

                                                                                                                                                            Download

                                                                                                                                                          • memory/1480-879-0x000007FEF0EB0000-0x000007FEF131E000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            4.4MB

                                                                                                                                                            Download

                                                                                                                                                          • memory/1552-554-0x000007FEF2480000-0x000007FEF28EE000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            4.4MB

                                                                                                                                                            Download

                                                                                                                                                          • memory/1608-15-0x0000000002030000-0x0000000002038000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            32KB

                                                                                                                                                            Download

                                                                                                                                                          • memory/1608-14-0x000000001B650000-0x000000001B932000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            2.9MB

                                                                                                                                                            Download

                                                                                                                                                          • memory/1772-373-0x000007FEF2D60000-0x000007FEF31CE000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            4.4MB

                                                                                                                                                            Download

                                                                                                                                                          • memory/1812-264-0x000007FEF31D0000-0x000007FEF363E000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            4.4MB

                                                                                                                                                            Download

                                                                                                                                                          • memory/2064-1316-0x000007FEED1E0000-0x000007FEED64E000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            4.4MB

                                                                                                                                                            Download

                                                                                                                                                          • memory/2096-766-0x000007FEF1730000-0x000007FEF1B9E000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            4.4MB

                                                                                                                                                            Download

                                                                                                                                                          • memory/2252-136-0x000007FEF3640000-0x000007FEF3AAE000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            4.4MB

                                                                                                                                                            Download

                                                                                                                                                          • memory/2380-6-0x00000000028E0000-0x0000000002960000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            512KB

                                                                                                                                                            Download

                                                                                                                                                          • memory/2380-7-0x000000001B690000-0x000000001B972000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            2.9MB

                                                                                                                                                            Download

                                                                                                                                                          • memory/2380-8-0x0000000002860000-0x0000000002868000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            32KB

                                                                                                                                                            Download

                                                                                                                                                          • memory/2504-1492-0x000007FEEC900000-0x000007FEECD6E000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            4.4MB

                                                                                                                                                            Download

                                                                                                                                                          • memory/2540-1213-0x000007FEED650000-0x000007FEEDABE000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            4.4MB

                                                                                                                                                            Download

                                                                                                                                                          • memory/2560-436-0x000007FEF28F0000-0x000007FEF2D5E000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            4.4MB

                                                                                                                                                            Download

                                                                                                                                                          • memory/2592-1-0x0000000000C80000-0x0000000001A40000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            13.8MB

                                                                                                                                                            Download

                                                                                                                                                          • memory/2592-0-0x000007FEF55E3000-0x000007FEF55E4000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            4KB

                                                                                                                                                            Download

                                                                                                                                                          • memory/2736-1040-0x000007FEEDF30000-0x000007FEEE39E000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            4.4MB

                                                                                                                                                            Download

                                                                                                                                                          • memory/2788-710-0x000007FEF1BA0000-0x000007FEF200E000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            4.4MB

                                                                                                                                                            Download

                                                                                                                                                          • memory/2960-609-0x000007FEF2010000-0x000007FEF247E000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            4.4MB

                                                                                                                                                            Download

                                                                                                                                                          • memory/2968-936-0x000007FEEE3A0000-0x000007FEEE80E000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            4.4MB

                                                                                                                                                            Download

                                                                                                                                                          • memory/3064-201-0x000007FEF3AB0000-0x000007FEF3F1E000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            4.4MB

                                                                                                                                                            Download