Analysis
-
max time kernel
150s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
25-01-2025 15:06
Static task
static1
Behavioral task
behavioral1
Sample
V1.7.1-Fixed.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
V1.7.1-Fixed.exe
Resource
win10v2004-20241007-en
General
-
Target
V1.7.1-Fixed.exe
-
Size
385.3MB
-
MD5
2a8232328ce1284a136daed4eef7aa9f
-
SHA1
7fff50776487cc4b04a56d229f00cdf9dd81c32a
-
SHA256
1d0c2aa2a51d30c38f461d7af3709c14ff9c5e009509733c453233b5d243eb8e
-
SHA512
651d80097d01074875c69dddd396108348306799cdae4ce63a15c985cad051a617ea102fca07c25cff71feaf13deebfe62d6dfc89666c574df6746bff89e2614
-
SSDEEP
12582912:XZy50LHPZAtgAzt//N0vsqNbCFxocf5HIdE:XZdLvZAzlAxmD1Iu
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2376 Exela.exe 2684 Exela.exe 2860 Exela.exe 2220 Exela.exe 656 Exela.exe 2424 Exela.exe 2212 Exela.exe 1232 Process not Found 2620 Exela.exe 2680 Exela.exe 1484 Exela.exe 1132 Exela.exe 2980 Exela.exe 2312 Exela.exe 2884 Exela.exe 696 Exela.exe 1984 Exela.exe 1736 Exela.exe 1512 Exela.exe 2456 Exela.exe 1244 Exela.exe 2852 Exela.exe 2216 Exela.exe 3032 Exela.exe 2848 Exela.exe 1364 Exela.exe 880 Exela.exe 1972 Exela.exe 1508 Exela.exe 2916 Exela.exe 1152 Exela.exe 3000 Exela.exe 2512 Exela.exe 284 Exela.exe 2824 Exela.exe 3016 Exela.exe 3028 Exela.exe 2208 Exela.exe 444 Exela.exe 2696 Exela.exe 2692 Exela.exe 2324 Exela.exe 960 Exela.exe 1172 Exela.exe 1720 Exela.exe 1116 Exela.exe 2936 Exela.exe 2296 Exela.exe 2016 Exela.exe 1548 Exela.exe 2172 Exela.exe 2656 Exela.exe 1356 Exela.exe 768 Exela.exe 1752 Exela.exe 2228 Exela.exe 348 Exela.exe 2772 Exela.exe 1144 Exela.exe 2300 Exela.exe 2156 Exela.exe 600 Exela.exe 2728 Exela.exe 1800 Exela.exe -
Loads dropped DLL 64 IoCs
pid Process 2196 V1.7.1-Fixed.exe 2376 Exela.exe 2684 Exela.exe 2684 Exela.exe 2684 Exela.exe 2684 Exela.exe 2684 Exela.exe 2684 Exela.exe 2684 Exela.exe 3000 V1.7.1-Fixed.exe 2860 Exela.exe 2220 Exela.exe 2220 Exela.exe 2220 Exela.exe 2220 Exela.exe 2220 Exela.exe 2220 Exela.exe 2220 Exela.exe 1772 V1.7.1-Fixed.exe 656 Exela.exe 2424 Exela.exe 2424 Exela.exe 2424 Exela.exe 2424 Exela.exe 2424 Exela.exe 2424 Exela.exe 2424 Exela.exe 768 V1.7.1-Fixed.exe 2760 V1.7.1-Fixed.exe 1908 V1.7.1-Fixed.exe 2212 Exela.exe 1484 Exela.exe 1484 Exela.exe 1484 Exela.exe 3036 V1.7.1-Fixed.exe 1484 Exela.exe 1484 Exela.exe 1484 Exela.exe 1484 Exela.exe 2620 Exela.exe 1492 V1.7.1-Fixed.exe 2980 Exela.exe 2980 Exela.exe 2980 Exela.exe 2680 Exela.exe 2980 Exela.exe 2884 Exela.exe 2980 Exela.exe 2980 Exela.exe 2884 Exela.exe 2884 Exela.exe 2884 Exela.exe 2980 Exela.exe 2884 Exela.exe 2884 Exela.exe 2884 Exela.exe 2660 V1.7.1-Fixed.exe 1132 Exela.exe 1984 Exela.exe 2312 Exela.exe 1984 Exela.exe 1736 Exela.exe 1984 Exela.exe 1736 Exela.exe -
resource yara_rule behavioral1/files/0x000500000001c72a-105.dat upx behavioral1/memory/2684-107-0x000007FEF5C10000-0x000007FEF6076000-memory.dmp upx behavioral1/memory/2220-211-0x000007FEF57A0000-0x000007FEF5C06000-memory.dmp upx behavioral1/memory/2424-315-0x000007FEF5230000-0x000007FEF5696000-memory.dmp upx behavioral1/files/0x000400000001d9c4-390.dat upx behavioral1/files/0x000400000001d9c2-389.dat upx behavioral1/files/0x000400000001d9be-387.dat upx behavioral1/files/0x000400000001d9bc-386.dat upx behavioral1/files/0x000400000001d9ba-385.dat upx behavioral1/files/0x000400000001d9b8-384.dat upx behavioral1/files/0x000400000001d9b6-383.dat upx behavioral1/files/0x000400000001d9b4-382.dat upx behavioral1/files/0x000400000001d9b2-381.dat upx behavioral1/files/0x000400000001d9b0-380.dat upx behavioral1/files/0x000400000001d9ae-379.dat upx behavioral1/files/0x000400000001d9ac-378.dat upx behavioral1/files/0x000400000001d9aa-377.dat upx behavioral1/files/0x000400000001d9a8-376.dat upx behavioral1/files/0x000400000001d9a6-375.dat upx behavioral1/files/0x000400000001d9e8-402.dat upx behavioral1/files/0x000400000001d9c6-401.dat upx behavioral1/files/0x000400000001de1a-574.dat upx behavioral1/files/0x000400000001de6c-575.dat upx behavioral1/files/0x000400000001de7c-579.dat upx behavioral1/memory/1484-577-0x000007FEF4DC0000-0x000007FEF5226000-memory.dmp upx behavioral1/files/0x000400000001de74-576.dat upx behavioral1/files/0x000400000001de94-583.dat upx behavioral1/files/0x000400000001de84-582.dat upx behavioral1/files/0x000400000001dec2-593.dat upx behavioral1/files/0x000400000001deba-592.dat upx behavioral1/files/0x000400000001deaf-590.dat upx behavioral1/files/0x000400000001dea6-588.dat upx behavioral1/files/0x000400000001dea2-587.dat upx behavioral1/files/0x000400000001de98-584.dat upx behavioral1/memory/2980-705-0x000007FEF4950000-0x000007FEF4DB6000-memory.dmp upx behavioral1/memory/2884-726-0x000007FEF44E0000-0x000007FEF4946000-memory.dmp upx behavioral1/memory/1984-814-0x000007FEF3F40000-0x000007FEF43A6000-memory.dmp upx behavioral1/memory/1736-822-0x000007FEF3AD0000-0x000007FEF3F36000-memory.dmp upx behavioral1/memory/2456-902-0x000007FEF3510000-0x000007FEF3976000-memory.dmp upx behavioral1/memory/1244-928-0x000007FEF2F50000-0x000007FEF33B6000-memory.dmp upx behavioral1/memory/2216-1014-0x000007FEF2990000-0x000007FEF2DF6000-memory.dmp upx behavioral1/memory/2848-1100-0x000007FEF23D0000-0x000007FEF2836000-memory.dmp upx behavioral1/memory/880-1186-0x000007FEF1E10000-0x000007FEF2276000-memory.dmp upx behavioral1/memory/1508-1273-0x000007FEEF640000-0x000007FEEFAA6000-memory.dmp upx behavioral1/memory/1152-1359-0x000007FEEE760000-0x000007FEEEBC6000-memory.dmp upx behavioral1/memory/2512-1451-0x000007FEEE2F0000-0x000007FEEE756000-memory.dmp upx behavioral1/memory/2824-1538-0x000007FEEDE80000-0x000007FEEE2E6000-memory.dmp upx behavioral1/memory/3028-1626-0x000007FEEDA10000-0x000007FEEDE76000-memory.dmp upx behavioral1/memory/444-1715-0x000007FEED5A0000-0x000007FEEDA06000-memory.dmp upx behavioral1/memory/2692-1802-0x000007FEED130000-0x000007FEED596000-memory.dmp upx behavioral1/memory/960-1889-0x000007FEECCC0000-0x000007FEED126000-memory.dmp upx behavioral1/memory/1720-1976-0x000007FEEC850000-0x000007FEECCB6000-memory.dmp upx -
Detects Pyinstaller 1 IoCs
resource yara_rule behavioral1/files/0x000900000001225f-2.dat pyinstaller -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2196 wrote to memory of 2376 2196 V1.7.1-Fixed.exe 30 PID 2196 wrote to memory of 2376 2196 V1.7.1-Fixed.exe 30 PID 2196 wrote to memory of 2376 2196 V1.7.1-Fixed.exe 30 PID 2196 wrote to memory of 2376 2196 V1.7.1-Fixed.exe 30 PID 2376 wrote to memory of 2684 2376 Exela.exe 31 PID 2376 wrote to memory of 2684 2376 Exela.exe 31 PID 2376 wrote to memory of 2684 2376 Exela.exe 31 PID 2196 wrote to memory of 3000 2196 V1.7.1-Fixed.exe 33 PID 2196 wrote to memory of 3000 2196 V1.7.1-Fixed.exe 33 PID 2196 wrote to memory of 3000 2196 V1.7.1-Fixed.exe 33 PID 2196 wrote to memory of 3000 2196 V1.7.1-Fixed.exe 33 PID 3000 wrote to memory of 2860 3000 V1.7.1-Fixed.exe 34 PID 3000 wrote to memory of 2860 3000 V1.7.1-Fixed.exe 34 PID 3000 wrote to memory of 2860 3000 V1.7.1-Fixed.exe 34 PID 3000 wrote to memory of 2860 3000 V1.7.1-Fixed.exe 34 PID 2860 wrote to memory of 2220 2860 Exela.exe 35 PID 2860 wrote to memory of 2220 2860 Exela.exe 35 PID 2860 wrote to memory of 2220 2860 Exela.exe 35 PID 3000 wrote to memory of 1772 3000 V1.7.1-Fixed.exe 36 PID 3000 wrote to memory of 1772 3000 V1.7.1-Fixed.exe 36 PID 3000 wrote to memory of 1772 3000 V1.7.1-Fixed.exe 36 PID 3000 wrote to memory of 1772 3000 V1.7.1-Fixed.exe 36 PID 1772 wrote to memory of 656 1772 V1.7.1-Fixed.exe 37 PID 1772 wrote to memory of 656 1772 V1.7.1-Fixed.exe 37 PID 1772 wrote to memory of 656 1772 V1.7.1-Fixed.exe 37 PID 1772 wrote to memory of 656 1772 V1.7.1-Fixed.exe 37 PID 656 wrote to memory of 2424 656 Exela.exe 38 PID 656 wrote to memory of 2424 656 Exela.exe 38 PID 656 wrote to memory of 2424 656 Exela.exe 38 PID 1772 wrote to memory of 768 1772 V1.7.1-Fixed.exe 39 PID 1772 wrote to memory of 768 1772 V1.7.1-Fixed.exe 39 PID 1772 wrote to memory of 768 1772 V1.7.1-Fixed.exe 39 PID 1772 wrote to memory of 768 1772 V1.7.1-Fixed.exe 39 PID 768 wrote to memory of 2212 768 V1.7.1-Fixed.exe 40 PID 768 wrote to memory of 2212 768 V1.7.1-Fixed.exe 40 PID 768 wrote to memory of 2212 768 V1.7.1-Fixed.exe 40 PID 768 wrote to memory of 2212 768 V1.7.1-Fixed.exe 40 PID 768 wrote to memory of 2760 768 V1.7.1-Fixed.exe 41 PID 768 wrote to memory of 2760 768 V1.7.1-Fixed.exe 41 PID 768 wrote to memory of 2760 768 V1.7.1-Fixed.exe 41 PID 768 wrote to memory of 2760 768 V1.7.1-Fixed.exe 41 PID 2760 wrote to memory of 2620 2760 V1.7.1-Fixed.exe 42 PID 2760 wrote to memory of 2620 2760 V1.7.1-Fixed.exe 42 PID 2760 wrote to memory of 2620 2760 V1.7.1-Fixed.exe 42 PID 2760 wrote to memory of 2620 2760 V1.7.1-Fixed.exe 42 PID 2760 wrote to memory of 1908 2760 V1.7.1-Fixed.exe 43 PID 2760 wrote to memory of 1908 2760 V1.7.1-Fixed.exe 43 PID 2760 wrote to memory of 1908 2760 V1.7.1-Fixed.exe 43 PID 2760 wrote to memory of 1908 2760 V1.7.1-Fixed.exe 43 PID 1908 wrote to memory of 2680 1908 V1.7.1-Fixed.exe 44 PID 1908 wrote to memory of 2680 1908 V1.7.1-Fixed.exe 44 PID 1908 wrote to memory of 2680 1908 V1.7.1-Fixed.exe 44 PID 1908 wrote to memory of 2680 1908 V1.7.1-Fixed.exe 44 PID 2212 wrote to memory of 1484 2212 Exela.exe 45 PID 2212 wrote to memory of 1484 2212 Exela.exe 45 PID 2212 wrote to memory of 1484 2212 Exela.exe 45 PID 1908 wrote to memory of 3036 1908 V1.7.1-Fixed.exe 46 PID 1908 wrote to memory of 3036 1908 V1.7.1-Fixed.exe 46 PID 1908 wrote to memory of 3036 1908 V1.7.1-Fixed.exe 46 PID 1908 wrote to memory of 3036 1908 V1.7.1-Fixed.exe 46 PID 3036 wrote to memory of 1132 3036 V1.7.1-Fixed.exe 47 PID 3036 wrote to memory of 1132 3036 V1.7.1-Fixed.exe 47 PID 3036 wrote to memory of 1132 3036 V1.7.1-Fixed.exe 47 PID 3036 wrote to memory of 1132 3036 V1.7.1-Fixed.exe 47
Processes
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2684
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2220
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:656 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2424
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:768 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1484
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"5⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2980
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"6⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"8⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2884
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"7⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"8⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1132 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"9⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1984
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"8⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"9⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"10⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1736
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"9⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"10⤵
- Executes dropped EXE
PID:696 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"11⤵
- Executes dropped EXE
PID:2456
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"10⤵
- System Location Discovery: System Language Discovery
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"11⤵
- Executes dropped EXE
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"12⤵
- Executes dropped EXE
PID:1244
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"11⤵
- System Location Discovery: System Language Discovery
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"12⤵
- Executes dropped EXE
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"13⤵
- Executes dropped EXE
PID:2216
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"12⤵PID:2540
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"13⤵
- Executes dropped EXE
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"14⤵
- Executes dropped EXE
PID:2848
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"13⤵
- System Location Discovery: System Language Discovery
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"14⤵
- Executes dropped EXE
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"15⤵
- Executes dropped EXE
PID:880
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"14⤵
- System Location Discovery: System Language Discovery
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"15⤵
- Executes dropped EXE
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"16⤵
- Executes dropped EXE
PID:1508
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"15⤵
- System Location Discovery: System Language Discovery
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"16⤵
- Executes dropped EXE
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"17⤵
- Executes dropped EXE
PID:1152
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"16⤵
- System Location Discovery: System Language Discovery
PID:444 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"17⤵
- Executes dropped EXE
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"18⤵
- Executes dropped EXE
PID:2512
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"17⤵PID:892
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"18⤵
- Executes dropped EXE
PID:284 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"19⤵
- Executes dropped EXE
PID:2824
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"18⤵
- System Location Discovery: System Language Discovery
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"19⤵
- Executes dropped EXE
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"20⤵
- Executes dropped EXE
PID:3028
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"19⤵
- System Location Discovery: System Language Discovery
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"20⤵
- Executes dropped EXE
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"21⤵
- Executes dropped EXE
PID:444
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"20⤵
- System Location Discovery: System Language Discovery
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"21⤵
- Executes dropped EXE
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"22⤵
- Executes dropped EXE
PID:2692
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"21⤵
- System Location Discovery: System Language Discovery
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"22⤵
- Executes dropped EXE
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"23⤵
- Executes dropped EXE
PID:960
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"22⤵
- System Location Discovery: System Language Discovery
PID:1312 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"23⤵
- Executes dropped EXE
PID:1172 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"24⤵
- Executes dropped EXE
PID:1720
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"23⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"24⤵
- Executes dropped EXE
PID:1116 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"25⤵
- Executes dropped EXE
PID:2936
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"24⤵PID:2448
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"25⤵
- Executes dropped EXE
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"26⤵
- Executes dropped EXE
PID:2016
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"25⤵PID:2500
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"26⤵
- Executes dropped EXE
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"27⤵
- Executes dropped EXE
PID:2172
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"26⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"27⤵
- Executes dropped EXE
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"28⤵
- Executes dropped EXE
PID:1356
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"27⤵
- System Location Discovery: System Language Discovery
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"28⤵
- Executes dropped EXE
PID:768 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"29⤵
- Executes dropped EXE
PID:1752
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"28⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"29⤵
- Executes dropped EXE
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"30⤵
- Executes dropped EXE
PID:348
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"29⤵
- System Location Discovery: System Language Discovery
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"30⤵
- Executes dropped EXE
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"31⤵
- Executes dropped EXE
PID:1144
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"30⤵
- System Location Discovery: System Language Discovery
PID:1180 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"31⤵
- Executes dropped EXE
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"32⤵
- Executes dropped EXE
PID:2156
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"31⤵
- System Location Discovery: System Language Discovery
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"32⤵
- Executes dropped EXE
PID:600 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"33⤵
- Executes dropped EXE
PID:2728
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"32⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"33⤵
- Executes dropped EXE
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"34⤵PID:2784
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"33⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"34⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"35⤵PID:2712
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"34⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"35⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"36⤵PID:1948
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"35⤵
- System Location Discovery: System Language Discovery
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"36⤵PID:1336
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"37⤵PID:1452
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"36⤵
- System Location Discovery: System Language Discovery
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"37⤵PID:2340
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"38⤵PID:928
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"37⤵PID:472
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"38⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"39⤵PID:2648
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"38⤵PID:2568
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"39⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"40⤵PID:2328
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"39⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"40⤵PID:2508
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"41⤵PID:848
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"40⤵
- System Location Discovery: System Language Discovery
PID:408 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"41⤵PID:988
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"42⤵PID:2676
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"41⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"42⤵PID:2672
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"43⤵PID:2812
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"42⤵PID:908
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"43⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"44⤵PID:2996
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"43⤵PID:900
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"44⤵PID:1440
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"45⤵PID:296
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"44⤵
- System Location Discovery: System Language Discovery
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"45⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"46⤵PID:2412
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"45⤵
- System Location Discovery: System Language Discovery
PID:1104 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"46⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"47⤵PID:3036
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"46⤵
- System Location Discovery: System Language Discovery
PID:488 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"47⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"48⤵PID:1596
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"47⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"48⤵PID:1696
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"49⤵PID:1060
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"48⤵PID:1292
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"49⤵PID:1852
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"50⤵PID:2584
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"49⤵
- System Location Discovery: System Language Discovery
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"50⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"51⤵PID:2384
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"50⤵
- System Location Discovery: System Language Discovery
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"51⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"52⤵PID:488
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"51⤵PID:900
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"52⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"53⤵PID:1732
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"52⤵PID:2840
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"53⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"54⤵PID:2568
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"53⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"54⤵PID:796
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"55⤵PID:1612
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"54⤵
- System Location Discovery: System Language Discovery
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"55⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"56⤵PID:3200
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"55⤵PID:3220
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"56⤵PID:3244
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"57⤵PID:3596
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"56⤵PID:3616
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"57⤵PID:3640
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"58⤵PID:3992
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"57⤵
- System Location Discovery: System Language Discovery
PID:4032 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"58⤵PID:4048
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"59⤵PID:3168
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"58⤵
- System Location Discovery: System Language Discovery
PID:3192 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"59⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"60⤵PID:3588
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"59⤵
- System Location Discovery: System Language Discovery
PID:3224 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"60⤵PID:3744
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"61⤵PID:1032
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"60⤵PID:4020
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"61⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"62⤵PID:1088
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"61⤵
- System Location Discovery: System Language Discovery
PID:4064 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"62⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"63⤵PID:3584
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"62⤵
- System Location Discovery: System Language Discovery
PID:3196 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"63⤵PID:3708
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"64⤵PID:1640
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"63⤵PID:2840
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"64⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"65⤵PID:3268
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"64⤵PID:3276
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"65⤵PID:3348
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"66⤵PID:3688
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"65⤵PID:3840
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"66⤵PID:3836
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"67⤵PID:3136
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"66⤵
- System Location Discovery: System Language Discovery
PID:3124 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"67⤵PID:3092
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"68⤵PID:3532
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"67⤵PID:3512
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"68⤵PID:3448
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"69⤵PID:3892
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"68⤵PID:3976
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"69⤵PID:2468
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"70⤵PID:2608
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"69⤵
- System Location Discovery: System Language Discovery
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"70⤵PID:3300
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"71⤵PID:3292
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"70⤵PID:3920
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"71⤵PID:3940
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"72⤵PID:3716
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"71⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"72⤵PID:3856
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"73⤵PID:3436
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"72⤵PID:3372
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"73⤵PID:3664
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"74⤵PID:3700
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"73⤵
- System Location Discovery: System Language Discovery
PID:3848 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"74⤵PID:3960
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"75⤵PID:3332
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"74⤵
- System Location Discovery: System Language Discovery
PID:3560 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"75⤵PID:840
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"76⤵PID:3804
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"75⤵PID:3752
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"76⤵PID:3888
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"77⤵PID:3816
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"76⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"77⤵PID:3512
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"78⤵PID:2976
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"77⤵PID:3152
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"78⤵PID:4064
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"79⤵PID:3916
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"78⤵PID:3140
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"79⤵PID:3484
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"80⤵PID:3984
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"79⤵
- System Location Discovery: System Language Discovery
PID:3304 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"80⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"81⤵PID:3408
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"80⤵PID:3148
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"81⤵PID:3680
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"82⤵PID:3936
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"81⤵
- System Location Discovery: System Language Discovery
PID:3312 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"82⤵PID:4020
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"83⤵PID:3568
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"82⤵
- System Location Discovery: System Language Discovery
PID:3364 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"83⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"84⤵PID:3024
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"83⤵
- System Location Discovery: System Language Discovery
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"84⤵PID:3124
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"85⤵PID:1604
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"84⤵PID:1180
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"85⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"86⤵PID:4036
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"85⤵PID:1400
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"86⤵PID:3956
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"87⤵PID:3792
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"86⤵
- System Location Discovery: System Language Discovery
PID:3904 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"87⤵PID:3868
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"88⤵PID:3652
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"87⤵PID:3616
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"88⤵PID:3464
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"89⤵PID:3524
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"88⤵PID:3404
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"89⤵PID:3296
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"90⤵PID:3656
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"89⤵
- System Location Discovery: System Language Discovery
PID:3384 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"90⤵PID:3616
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"91⤵PID:3152
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"90⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"91⤵PID:3392
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"92⤵PID:2292
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"91⤵
- System Location Discovery: System Language Discovery
PID:3796 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"92⤵PID:3976
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"93⤵PID:3660
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"92⤵
- System Location Discovery: System Language Discovery
PID:3312 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"93⤵PID:3780
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"94⤵PID:4144
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"93⤵PID:4156
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"94⤵PID:4172
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"95⤵PID:4532
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"94⤵PID:4552
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"95⤵PID:4572
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"96⤵PID:4924
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"95⤵PID:4940
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"96⤵PID:4956
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"97⤵PID:1396
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"96⤵
- System Location Discovery: System Language Discovery
PID:3572 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"97⤵PID:4044
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"98⤵PID:4408
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"97⤵PID:4436
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"98⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"99⤵PID:4596
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"98⤵
- System Location Discovery: System Language Discovery
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"99⤵PID:4692
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"100⤵PID:3924
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"99⤵PID:4068
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"100⤵PID:3740
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"101⤵PID:3312
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"100⤵
- System Location Discovery: System Language Discovery
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"101⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"102⤵PID:4600
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"101⤵PID:4444
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"102⤵PID:4556
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"103⤵PID:2576
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"102⤵
- System Location Discovery: System Language Discovery
PID:4700 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"103⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"104⤵PID:3440
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"103⤵
- System Location Discovery: System Language Discovery
PID:3580 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"104⤵PID:4548
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"105⤵PID:4396
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"104⤵PID:3764
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"105⤵PID:3116
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"106⤵PID:3424
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"105⤵PID:4364
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"106⤵PID:4292
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"107⤵PID:4680
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"106⤵
- System Location Discovery: System Language Discovery
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"107⤵PID:4624
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"108⤵PID:4912
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"107⤵
- System Location Discovery: System Language Discovery
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"108⤵PID:4664
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"109⤵PID:3728
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"108⤵PID:1180
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"109⤵PID:4304
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"110⤵PID:4472
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"109⤵PID:4200
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"110⤵PID:4856
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"111⤵PID:4412
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"110⤵
- System Location Discovery: System Language Discovery
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"111⤵PID:3108
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"112⤵PID:4628
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"111⤵PID:4312
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"112⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"113⤵PID:5056
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"112⤵
- System Location Discovery: System Language Discovery
PID:4032 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"113⤵PID:4984
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"114⤵PID:1664
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"113⤵
- System Location Discovery: System Language Discovery
PID:4140 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"114⤵PID:4324
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"115⤵PID:4156
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"114⤵PID:1004
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"115⤵PID:4616
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"116⤵PID:4236
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"115⤵PID:4564
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"116⤵PID:4092
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"117⤵PID:4812
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"116⤵PID:4516
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"117⤵PID:5000
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"118⤵PID:5036
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"117⤵
- System Location Discovery: System Language Discovery
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"118⤵PID:4264
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"119⤵PID:4732
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"118⤵PID:584
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"119⤵PID:4824
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"120⤵PID:3608
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"119⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"120⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"121⤵PID:4772
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"120⤵
- System Location Discovery: System Language Discovery
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"121⤵PID:4668
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"122⤵PID:3188
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-