c6b47021e726c231d5bf42e4f00c508f8b09a6e84298dd24cf78cf8cfff156a1

Analysis

max time kernel
99s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
11/11/2023, 16:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https_payload_ngrok_outfile.ps1
Size

652B
MD5

13c92198a13297e9eed861b8a75e7a4f
SHA1

e6c1878905d94e4719f301bd42fa2dca86320e93
SHA256

c6b47021e726c231d5bf42e4f00c508f8b09a6e84298dd24cf78cf8cfff156a1
SHA512

e034c537f40f6207e221695b296a009f046ec56d6d4586431dc1c9c245cceb5f62684b7a22766ae9bd6563e7b4b263b388c9d103037d09df448408b238ecd344

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
688	powershell.exe
688	powershell.exe
4448	powershell.exe
4448	powershell.exe
2456	powershell.exe
2456	powershell.exe
3332	powershell.exe
3332	powershell.exe
3852	powershell.exe
3852	powershell.exe
2168	powershell.exe
2168	powershell.exe
4460	powershell.exe
4460	powershell.exe
4460	powershell.exe
3028	powershell.exe
3028	powershell.exe
3028	powershell.exe
4528	powershell.exe
4528	powershell.exe
4528	powershell.exe
676	powershell.exe
676	powershell.exe
676	powershell.exe
5004	powershell.exe
5004	powershell.exe
5004	powershell.exe
3472	powershell.exe
3472	powershell.exe
3472	powershell.exe
2800	powershell.exe
2800	powershell.exe
2800	powershell.exe
456	powershell.exe
456	powershell.exe
456	powershell.exe
5028	powershell.exe
5028	powershell.exe
5028	powershell.exe
3852	powershell.exe
3852	powershell.exe
3852	powershell.exe
4228	powershell.exe
4228	powershell.exe
4228	powershell.exe
4980	powershell.exe
4980	powershell.exe
4980	powershell.exe
1724	powershell.exe
1724	powershell.exe
1724	powershell.exe
4132	powershell.exe
4132	powershell.exe
4132	powershell.exe
2744	powershell.exe
2744	powershell.exe
2744	powershell.exe
2788	powershell.exe
2788	powershell.exe
2788	powershell.exe
4140	powershell.exe
4140	powershell.exe
4140	powershell.exe
4364	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	688	powershell.exe
Token: SeDebugPrivilege	4448	powershell.exe
Token: SeDebugPrivilege	2456	powershell.exe
Token: SeDebugPrivilege	3332	powershell.exe
Token: SeDebugPrivilege	3852	powershell.exe
Token: SeDebugPrivilege	2168	powershell.exe
Token: SeDebugPrivilege	4460	powershell.exe
Token: SeDebugPrivilege	3028	powershell.exe
Token: SeDebugPrivilege	4528	powershell.exe
Token: SeDebugPrivilege	676	powershell.exe
Token: SeDebugPrivilege	5004	powershell.exe
Token: SeDebugPrivilege	3472	powershell.exe
Token: SeDebugPrivilege	2800	powershell.exe
Token: SeDebugPrivilege	456	powershell.exe
Token: SeDebugPrivilege	5028	powershell.exe
Token: SeDebugPrivilege	3852	powershell.exe
Token: SeDebugPrivilege	4228	powershell.exe
Token: SeDebugPrivilege	4980	powershell.exe
Token: SeDebugPrivilege	1724	powershell.exe
Token: SeDebugPrivilege	4132	powershell.exe
Token: SeDebugPrivilege	2744	powershell.exe
Token: SeDebugPrivilege	2788	powershell.exe
Token: SeDebugPrivilege	4140	powershell.exe
Token: SeDebugPrivilege	4364	powershell.exe
Token: SeDebugPrivilege	2392	powershell.exe
Token: SeDebugPrivilege	1288	powershell.exe
Token: SeDebugPrivilege	2540	powershell.exe
Token: SeDebugPrivilege	3632	powershell.exe
Token: SeDebugPrivilege	5024	powershell.exe
Token: SeDebugPrivilege	4536	powershell.exe
Token: SeDebugPrivilege	4388	powershell.exe
Token: SeDebugPrivilege	4452	BackgroundTransferHost.exe
Token: SeDebugPrivilege	4020	powershell.exe
Token: SeDebugPrivilege	1808	powershell.exe
Token: SeDebugPrivilege	4792	powershell.exe
Token: SeDebugPrivilege	4284	powershell.exe
Token: SeDebugPrivilege	1796	powershell.exe
Token: SeDebugPrivilege	1944	powershell.exe
Token: SeDebugPrivilege	476	powershell.exe
Token: SeDebugPrivilege	2028	powershell.exe
Token: SeDebugPrivilege	508	powershell.exe
Token: SeDebugPrivilege	1832	powershell.exe
Token: SeDebugPrivilege	4568	powershell.exe
Token: SeDebugPrivilege	3060	powershell.exe
Token: SeDebugPrivilege	3856	powershell.exe
Token: SeDebugPrivilege	3436	powershell.exe
Token: SeDebugPrivilege	2272	powershell.exe
Token: SeDebugPrivilege	4868	powershell.exe
Token: SeDebugPrivilege	2196	powershell.exe
Token: SeDebugPrivilege	3028	powershell.exe
Token: SeDebugPrivilege	4480	powershell.exe
Token: SeDebugPrivilege	3460	powershell.exe
Token: SeDebugPrivilege	4040	powershell.exe
Token: SeDebugPrivilege	4956	powershell.exe
Token: SeDebugPrivilege	4496	powershell.exe
Token: SeDebugPrivilege	4600	powershell.exe
Token: SeDebugPrivilege	4228	powershell.exe
Token: SeDebugPrivilege	2252	powershell.exe
Token: SeDebugPrivilege	556	powershell.exe
Token: SeDebugPrivilege	3856	powershell.exe
Token: SeDebugPrivilege	4660	powershell.exe
Token: SeDebugPrivilege	2976	powershell.exe
Token: SeDebugPrivilege	4284	powershell.exe
Token: SeDebugPrivilege	3812	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 688 wrote to memory of 4448	688	powershell.exe	88
PID 688 wrote to memory of 4448	688	powershell.exe	88
PID 688 wrote to memory of 2456	688	powershell.exe	93
PID 688 wrote to memory of 2456	688	powershell.exe	93
PID 688 wrote to memory of 3332	688	powershell.exe	94
PID 688 wrote to memory of 3332	688	powershell.exe	94
PID 688 wrote to memory of 3852	688	powershell.exe	113
PID 688 wrote to memory of 3852	688	powershell.exe	113
PID 688 wrote to memory of 2168	688	powershell.exe	98
PID 688 wrote to memory of 2168	688	powershell.exe	98
PID 688 wrote to memory of 4460	688	powershell.exe	101
PID 688 wrote to memory of 4460	688	powershell.exe	101
PID 688 wrote to memory of 3028	688	powershell.exe	102
PID 688 wrote to memory of 3028	688	powershell.exe	102
PID 688 wrote to memory of 4528	688	powershell.exe	104
PID 688 wrote to memory of 4528	688	powershell.exe	104
PID 688 wrote to memory of 676	688	powershell.exe	105
PID 688 wrote to memory of 676	688	powershell.exe	105
PID 688 wrote to memory of 5004	688	powershell.exe	108
PID 688 wrote to memory of 5004	688	powershell.exe	108
PID 688 wrote to memory of 3472	688	powershell.exe	109
PID 688 wrote to memory of 3472	688	powershell.exe	109
PID 688 wrote to memory of 2800	688	powershell.exe	110
PID 688 wrote to memory of 2800	688	powershell.exe	110
PID 688 wrote to memory of 456	688	powershell.exe	111
PID 688 wrote to memory of 456	688	powershell.exe	111
PID 688 wrote to memory of 5028	688	powershell.exe	112
PID 688 wrote to memory of 5028	688	powershell.exe	112
PID 688 wrote to memory of 3852	688	powershell.exe	113
PID 688 wrote to memory of 3852	688	powershell.exe	113
PID 688 wrote to memory of 4228	688	powershell.exe	115
PID 688 wrote to memory of 4228	688	powershell.exe	115
PID 688 wrote to memory of 4980	688	powershell.exe	116
PID 688 wrote to memory of 4980	688	powershell.exe	116
PID 688 wrote to memory of 1724	688	powershell.exe	117
PID 688 wrote to memory of 1724	688	powershell.exe	117
PID 688 wrote to memory of 4132	688	powershell.exe	118
PID 688 wrote to memory of 4132	688	powershell.exe	118
PID 688 wrote to memory of 2744	688	powershell.exe	119
PID 688 wrote to memory of 2744	688	powershell.exe	119
PID 688 wrote to memory of 2788	688	powershell.exe	120
PID 688 wrote to memory of 2788	688	powershell.exe	120
PID 688 wrote to memory of 4140	688	powershell.exe	121
PID 688 wrote to memory of 4140	688	powershell.exe	121
PID 688 wrote to memory of 4364	688	powershell.exe	122
PID 688 wrote to memory of 4364	688	powershell.exe	122
PID 688 wrote to memory of 2392	688	powershell.exe	123
PID 688 wrote to memory of 2392	688	powershell.exe	123
PID 688 wrote to memory of 1288	688	powershell.exe	124
PID 688 wrote to memory of 1288	688	powershell.exe	124
PID 688 wrote to memory of 2540	688	powershell.exe	125
PID 688 wrote to memory of 2540	688	powershell.exe	125
PID 688 wrote to memory of 3632	688	powershell.exe	126
PID 688 wrote to memory of 3632	688	powershell.exe	126
PID 688 wrote to memory of 5024	688	powershell.exe	127
PID 688 wrote to memory of 5024	688	powershell.exe	127
PID 688 wrote to memory of 4536	688	powershell.exe	128
PID 688 wrote to memory of 4536	688	powershell.exe	128
PID 688 wrote to memory of 4388	688	powershell.exe	129
PID 688 wrote to memory of 4388	688	powershell.exe	129
PID 688 wrote to memory of 4452	688	powershell.exe	152
PID 688 wrote to memory of 4452	688	powershell.exe	152
PID 688 wrote to memory of 4020	688	powershell.exe	131
PID 688 wrote to memory of 4020	688	powershell.exe	131

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\https_payload_ngrok_outfile.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:688
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4448
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2456
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3332
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  PID:3852
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2168
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4460
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3028
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4528
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:676
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5004
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3472
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2800
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:456
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5028
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3852
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4228
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4980
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1724
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4132
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2744
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2788
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4140
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4364
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2392
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1288
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2540
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3632
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5024
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4536
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4388
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  PID:4452
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4020
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1808
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4792
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  PID:4284
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1796
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1944
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:476
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2028
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:508
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1832
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4568
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3060
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  PID:3856
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3436
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  PID:2272
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4868
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2196
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3028
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4480
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3460
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4040
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4956
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4496
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4600
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4228
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2252
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:556
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3856
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4660
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2976
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4284
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3812
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  PID:2128
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  PID:4656
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  PID:1512
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2272
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  PID:3920
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  PID:1036
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  PID:2824
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  PID:3620
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  PID:2840
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  PID:2464
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  PID:3704
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  PID:2924
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  PID:440
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  PID:1908
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  PID:5092
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  PID:2080
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  PID:1092
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  PID:4568
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  PID:4652
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  PID:1036
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  PID:676
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  PID:1512
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  PID:2016
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  PID:456
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  PID:3668
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  PID:3760
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  PID:2188
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  PID:3704
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  PID:1944
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  PID:3800
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  PID:3836
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  PID:3448
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  PID:1748
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  PID:1176
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  PID:2100
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  PID:1108
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  PID:2288
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  PID:2008
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  PID:4500
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  PID:1980
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  PID:2012
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  PID:2080
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  PID:5000
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  PID:4636
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  PID:476
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  PID:4548
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  PID:1660
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  PID:2852
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  PID:4132
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  PID:2168
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  PID:500
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  PID:3864
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  PID:3520
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  PID:3580
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  PID:1836
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  PID:4496
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  PID:3876
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  PID:4848
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  PID:3468
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  PID:4568
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  PID:2572
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  PID:4888
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass *OUTFILE* -ErrorAction Stop -ErrorVariable e
  2⤵
  PID:2012

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4452

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
120c6c9af4de2accfcff2ed8c3aab1af

SHA1
504f64ae4ac9c4fe308a6a50be24fe464f3dad95

SHA256
461315e4057c3fa4d0031df3f7e6511914f082698b6c41f5c2ada831ceffb222

SHA512
041712168718dff702da8203b4089b2e57db98ce503b8ecf36809dec0cd7a595a0d427caa960bc1bd29cbedc85ad3262773f2077a476b85aca387d48f7b07ba2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
120c6c9af4de2accfcff2ed8c3aab1af

SHA1
504f64ae4ac9c4fe308a6a50be24fe464f3dad95

SHA256
461315e4057c3fa4d0031df3f7e6511914f082698b6c41f5c2ada831ceffb222

SHA512
041712168718dff702da8203b4089b2e57db98ce503b8ecf36809dec0cd7a595a0d427caa960bc1bd29cbedc85ad3262773f2077a476b85aca387d48f7b07ba2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
5ccdfe8b7781c09ed55a9fb496c802f2

SHA1
a5b6103034b5b890a70072646328f43d46a40789

SHA256
6037f5b95e40ad628388e11e6b3a499d714a3c43db62672a9d0cd088704c76d4

SHA512
d5153e0b15e1ccb6543e66b50d9306743dd9c31b22332ca78c6b533d9365eb893f2c9b8028c9ba22411287b414e44c09a5b14769830611d764484af24d81a3c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
91e89794a950f0c7d439595297e31036

SHA1
73ffcbd7ed7056221d2758180139fad6131aa726

SHA256
a987ca7d465ab74e819f81a0f13713e60a530f371c0dc0b5da1f16042f4166a1

SHA512
7c689da0d24e237c3633843700d04e831fa027f8f6818e14620956088f34f08a5202cbafef81ceb5b88786af7593286642b1d9b653b994bc4c09f7e1a638985f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
743b15d0e2a0ceb83119dc17ee49b1cc

SHA1
08caaf15c50393e0a8abcadfb30cd017ce3f9fc0

SHA256
70f62097a48ff54ffdbf69b99b013b3615c4b1d832385816fd25d78fcfd238c0

SHA512
12cdcbc6efb42aaadda838837cf37bfecaeea60f0418829cf5e3e428ec52e1153cabee48a3ac24e7e8d0cfec9b9ba45807a699f834b4600eb91224753fd56051

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
0d8abf9638c74e2459427f0738f597a0

SHA1
7f0d7f08e3bab3736388f3db7e5cb5beb726ef4d

SHA256
cad3af71b0b153675d87318a3fd44524d95a1b158549e5dd94d64795972d9382

SHA512
52e226e566b0b3b3800538c452deccde78ca22fbc47139c34e9f35fc49c2549b44ac4e5c5debc0692251244757af6f2ab447cad4c28fa6a2711661c472ae7b30

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
10890cda4b6eab618e926c4118ab0647

SHA1
1e1d63b73a0e6c7575f458b3c7917a9ce5ba776d

SHA256
00f8a035324d39bd62e6dee5e1b480069015471c487ebee4479e6990ea9ddb14

SHA512
a2ee84006c24a36f25e0bca0772430d64e3791f233da916aecdeae6712763e77d55bbbd00dc8f6b2b3887f3c26ab3980b96c5f46cc823e81e28abbbc5fc78221

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
83685d101174171875b4a603a6c2a35c

SHA1
37be24f7c4525e17fa18dbd004186be3a9209017

SHA256
0c557845aab1da497bbff0e8fbe65cabf4cb2804b97ba8ae8c695a528af70870

SHA512
005a97a8e07b1840abdcef86a7881fd9bdc8acbfdf3eafe1dceb6374060626d81d789e57d87ca4096a39e28d5cca00f8945edff0a747591691ae75873d2b3fb5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
0026cdd9bbc34b9de2447c0eb04c14b5

SHA1
ab7713fe5fbbb23031937dd1dc7d0fa238884ad4

SHA256
cf5a1c42641a83dd41fe89923591962b7ad189006342c7a67669239688f84a2d

SHA512
62aab723672e2731946f4bbf6a3d92609ff94384e324f3c50e803095529baf848ce2cd37219a059ced4c3f559e598bd9b900b9dd8aa0657adca6d845127797fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
eb033be02578f9635ec47bdc1de5c3fb

SHA1
ec356bc87381354a06baa9c30e8c3ac3d30e0f6f

SHA256
bd827af3192bf83c75a32e51ed2de83bd3b90d6b99350721a189a57cec15d063

SHA512
4d8778503646f7016df73ff9d204760f4fe4d2b24157920ac3e5651653373975b2f2d229530143059f11b16c42822ad7963e628ad6066022ee712c17d90595ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
1226cbe1b9180c106bb1c6df4c56e023

SHA1
b42e0f4e40a8713c0300a8852d7c2a5690e03bbc

SHA256
413900875971fd21b31b0613362ef890e03901dca5bc6d9a2754bf5358d92a7f

SHA512
01caa250c5a3d68cd6dfb9ab3d97c6681aa3f004f1a23fb64dccc74c509a4c6a65fdc7c26d55ff84c1f5d34a91193b697f0834be6059c9bb381c5209033f75bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
b51dc9e5ec3c97f72b4ca9488bbb4462

SHA1
5c1e8c0b728cd124edcacefb399bbd5e25b21bd3

SHA256
976f9534aa2976c85c2455bdde786a3f55d63aefdd40942eba1223c4c93590db

SHA512
0e5aa6cf64c535aefb833e5757b68e1094c87424abe2615a7d7d26b1b31eff358d12e36e75ca57fd690a9919b776600bf4c5c0e5a5df55366ba62238bdf3f280

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
7e6fb773ca334f5d3ec171e50780b590

SHA1
8c6b533415de54e4b71282f94a3ac40bdb0ce166

SHA256
997512026c7564ea7cea6451277db3b8e70699faae8e6b06a022448f80e8cd0f

SHA512
7e1340bd1ad2574ca34d4f0d92a80d93b31b9e70146911490188c36b4a3b2d7305f05e059fa7571b0b9fb5ed6ec5d98f4ab9532454048ec3fec387654977cc3d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
be67063c62a242565760a02a642a9f02

SHA1
d1043a892b44d6676f71b568f578fff947266a19

SHA256
56f158298dc5f781d6636a0b15d040f9cffb1d46cd11079aa40a26b662217f48

SHA512
90d2cbd882ff8043412ad25e74df0cf6b71d6f3fbdfa6f1efa0efc8eed86a925606c7d2e967f112a34d3f0e04f01a396898508571400dcf7e6fd69e78f406638

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
51cf8df21f531e31f7740b4ec487a48a

SHA1
40c6a73b22d71625a62df109aefc92a5f9b9d13e

SHA256
263d9b98a897d1d66da4832af640c4bf5ab0ae91125ba12243453dfe714f3d0d

SHA512
57a85461f6ea96b26a8b53d3a9cca18543e4ddbe996e8f412fc4cf7cf6e9ffe558c96da7b322a42f18bef62020e65aee119bed6102f75e2f605df09b02ec6368

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
65a68df1062af34622552c4f644a5708

SHA1
6f6ecf7b4b635abb0b132d95dac2759dc14b50af

SHA256
718dc2f5f4a6dbb7fab7f3db05bd7f602fb16526caae7084ab46c3ab4e7bad35

SHA512
4e460eb566032942547b58411222dd26ae300a95f83cf5ae6df58ebd28594341123611b348bd4031a33bc7f38307d5cb8fb677bba8c896919e3eee677a104d4d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3b444d3f0ddea49d84cc7b3972abe0e6

SHA1
0a896b3808e68d5d72c2655621f43b0b2c65ae02

SHA256
ab075b491d20c6f66c7bd40b57538c1cfdaab5aac4715bfe3bbc7f4745860a74

SHA512
eb0ab5d68472ec42de4c9b6d84306d7bca3874be1d0ac572030a070f21a698432418068e1a6006ff88480be8c8f54c769dee74b2def403f734109dba7261f36b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
110b59ca4d00786d0bde151d21865049

SHA1
557e730d93fdf944a0cad874022df1895fb5b2e2

SHA256
77f69011c214ea5a01fd2035d781914c4893aee66d784deadc22179eadfdf77f

SHA512
cb55ac6eca50f4427718bace861679c88b2fdfea94d30209e8d61ca73a6ce9f8c4b5334922d2660a829b0636d20cbdf3bae1497c920e604efe6c636019feb10e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e58749a7a1826f6ea62df1e2ef63a32b

SHA1
c0bca21658b8be4f37b71eec9578bfefa44f862d

SHA256
0e1f0e684adb40a5d0668df5fed007c9046137d7ae16a1f2f343b139d5f9bc93

SHA512
4cf45b2b11ab31e7f67fff286b29d50ed28cd6043091144c5c0f1348b5f5916ed7479cf985595e6f096b586ab93b4b5dce612f688049b8366a2dd91863e98b70

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
10890cda4b6eab618e926c4118ab0647

SHA1
1e1d63b73a0e6c7575f458b3c7917a9ce5ba776d

SHA256
00f8a035324d39bd62e6dee5e1b480069015471c487ebee4479e6990ea9ddb14

SHA512
a2ee84006c24a36f25e0bca0772430d64e3791f233da916aecdeae6712763e77d55bbbd00dc8f6b2b3887f3c26ab3980b96c5f46cc823e81e28abbbc5fc78221

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
50d3033f2bc3a3774c469d03e71a79a9

SHA1
22027b1d52085de99b3bffa276530fea5d961471

SHA256
2987e99ec7fa17bd4ab7de3cb4dc62645e1052012a5a357904d6fc6db9054147

SHA512
ecf7ab1a9e4192454a3e24c60453fd702a8c648e00078fc933b9182f4a3d3c10c6f5da622a5729b35727e6ddc8837029caddcaf76f56e805b9744253b56da5d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
735388b98281cec7d063b1b470c13632

SHA1
7536ce1c5f3732fac491d7038e24124551c4290a

SHA256
843fced254477f5ad803cc98e853d7ab674852d5e94bc174497691b736d49e69

SHA512
30244c596f4c3cc0194186a210170f04985b77fc90f10cff0a2fbd07e079944e5f8c9998759219363033c450b6a4093ad1b3d75e0a0fae1aa6208a61a88a9717

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
ce4540390cc4841c8973eb5a3e9f4f7d

SHA1
2293f30a6f4c9538bc5b06606c10a50ab4ecef8e

SHA256
e834e1da338b9644d538cefd70176768816da2556939c1255d386931bd085105

SHA512
2a3e466cb5a81d2b65256053b768a98321eb3e65ff46353eefc9864f14a391748116f050e7482ddd73a51575bf0a6fc5c673023dade62dbd8b174442bae1cc6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e5663972c1caaba7088048911c758bf3

SHA1
3462dea0f9c2c16a9c3afdaef8bbb1f753c1c198

SHA256
9f7f29a4696876cadca3f14d7e43f9ede0c97fd64be3f5d94bda49a91b6a419e

SHA512
ff4e72c46cf083de62baa2ce2661555dd91b5f144294015f7b262fd4500cb67fe80e1871a82da63b607e3e9cef401f4b73c587bf1134637881ecad51aad1eddc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
9bc110200117a3752313ca2acaf8a9e1

SHA1
fda6b7da2e7b0175b391475ca78d1b4cf2147cd3

SHA256
c88e4bbb64f7fa31429ebe82c1cf07785c44486f37576f783a26ac856e02a4eb

SHA512
1f1af32aa18a8cbfcc65b0d4fb7e6ca2705f125eaa85789e981ee68b90c64522e954825abf460d4b4f97567715dfae8d9b0a25a4d54d10bc4c257c472f2e80fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
60945d1a2e48da37d4ce8d9c56b6845a

SHA1
83e80a6acbeb44b68b0da00b139471f428a9d6c1

SHA256
314b91c00997034d6e015f40230d90ebbf57de5dc938b62c1a214d591793dbe3

SHA512
5d068f1d6443e26ae3cad1c80f969e50e5860967b314153c4d3b6efd1cfa39f0907c6427bec7fa43db079f258b6357e4e9a1b0b1a36b1481d2049ea0e67909ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
9bc110200117a3752313ca2acaf8a9e1

SHA1
fda6b7da2e7b0175b391475ca78d1b4cf2147cd3

SHA256
c88e4bbb64f7fa31429ebe82c1cf07785c44486f37576f783a26ac856e02a4eb

SHA512
1f1af32aa18a8cbfcc65b0d4fb7e6ca2705f125eaa85789e981ee68b90c64522e954825abf460d4b4f97567715dfae8d9b0a25a4d54d10bc4c257c472f2e80fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
dd1d0b083fedf44b482a028fb70b96e8

SHA1
dc9c027937c9f6d52268a1504cbae42a39c8d36a

SHA256
cab7944d29e0501dc0db904ac460ca7a87700e0ec7eb62298b7b97cbf40c424c

SHA512
96bec38bfda176292ae65dcf735103e7888baa212038737c1d1e215fcb76e4c0355e4a827a1934303e7aecae91012fa412f13e38f382b732758bae985cc67973

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
2e907f77659a6601fcc408274894da2e

SHA1
9f5b72abef1cd7145bf37547cdb1b9254b4efe9d

SHA256
385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233

SHA512
34fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e58749a7a1826f6ea62df1e2ef63a32b

SHA1
c0bca21658b8be4f37b71eec9578bfefa44f862d

SHA256
0e1f0e684adb40a5d0668df5fed007c9046137d7ae16a1f2f343b139d5f9bc93

SHA512
4cf45b2b11ab31e7f67fff286b29d50ed28cd6043091144c5c0f1348b5f5916ed7479cf985595e6f096b586ab93b4b5dce612f688049b8366a2dd91863e98b70

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
9a2c763c5ff40e18e49ad63c7c3b0088

SHA1
4b289ea34755323fa869da6ad6480d8d12385a36

SHA256
517807921c55bd16cd8a8bfae3d5dc19444c66f836b66acd5593e3080acbaf8e

SHA512
3af01926bc7de92076067d158d7250b206d396b3282ee0db43639d04d91bd9ff763acbce12c7822914824984a3c5fdd1b8dbf1ad2ee88233d47f0f808b746bc8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
49c00d6f739fea600e39f3ebeb1ba2f0

SHA1
eb498e3a02f258ba32544a9d719d872470aed8ab

SHA256
c41f4920d96ce20885847e1b11d895a0962a9b61cf18ef03553e169ea2873502

SHA512
711084ac213e154c0e569e969ed9d6a6100d9f551d18177031eb7d45dc2c59691ba996f523568b538b8d74bc288236e2ddaa7c0cd2dd23223db7112abf3d2cdf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
c94af379fe0d2afdabe4476dc7232198

SHA1
ae6ebf37fd84cf66dcd330e998f972a4d0a21b72

SHA256
7a1017d506434a4bd30a8ab78c064881313d14d95bc8b4e13589824b4caf9a07

SHA512
80e112fe35b27c0e85b657ec158583faf742157f27e8ff00ea1e4f3d688ac173bd154bb0dec19aee43f7035c2b4b7156373a52f0642773dee0a01fcb37844144

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3fd1207fb34732237602c32614f8e7a5

SHA1
3c17778095da518c209e6854340c140cff556a50

SHA256
b89786113f914c4c6c44f0455750d167a760b375dc12c18a52054e71f0d24737

SHA512
54e7f41aa11b147d6734d1b2972c11dd6a4703be366dd9b26dbca14a9392205a4f19545c39db9807751468522c9e761fe7009bebf743e3ef852d7b79429ba482

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
ab1c06eb58feaa4c391aca847a9d8c22

SHA1
7135120dfad41b4d64e675294e1b974891b3ee76

SHA256
3705f63962d11b61c726853043b5c47800b77b3392f8ef42921fb31514eeba8e

SHA512
8fe9947248e64b2cb94af62bc8126f4c13700254a17a204b58535cb9ad32919be5aeca0e745127ceb8c666dc3b3140bb406d7591b32531c6c3eb1771ee571edb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
49c00d6f739fea600e39f3ebeb1ba2f0

SHA1
eb498e3a02f258ba32544a9d719d872470aed8ab

SHA256
c41f4920d96ce20885847e1b11d895a0962a9b61cf18ef03553e169ea2873502

SHA512
711084ac213e154c0e569e969ed9d6a6100d9f551d18177031eb7d45dc2c59691ba996f523568b538b8d74bc288236e2ddaa7c0cd2dd23223db7112abf3d2cdf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
f5ea6e485a296269f874f3d12709ce50

SHA1
c73e5adec8ceef00e49e0f51d382b990fc5b4d4c

SHA256
980d5cc1b33f9995ce40b593bac646373b613070e5ca6da2c297c5fb8c1f28c3

SHA512
09e3083c712ae875d1dae3d4c903e96e6f5e97f5a15d4301319d3f6f63b2e704ce1b728704fd4ada7f0c26b782b05b551f961db8775f7527b1b1b224e7478659

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
83685d101174171875b4a603a6c2a35c

SHA1
37be24f7c4525e17fa18dbd004186be3a9209017

SHA256
0c557845aab1da497bbff0e8fbe65cabf4cb2804b97ba8ae8c695a528af70870

SHA512
005a97a8e07b1840abdcef86a7881fd9bdc8acbfdf3eafe1dceb6374060626d81d789e57d87ca4096a39e28d5cca00f8945edff0a747591691ae75873d2b3fb5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
83685d101174171875b4a603a6c2a35c

SHA1
37be24f7c4525e17fa18dbd004186be3a9209017

SHA256
0c557845aab1da497bbff0e8fbe65cabf4cb2804b97ba8ae8c695a528af70870

SHA512
005a97a8e07b1840abdcef86a7881fd9bdc8acbfdf3eafe1dceb6374060626d81d789e57d87ca4096a39e28d5cca00f8945edff0a747591691ae75873d2b3fb5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
cfb22e9b9c08bb1cfe944b622eb7adcb

SHA1
a299c701fb4da010999e61f9127262c7deb4fd97

SHA256
f60461e45422c16638ab514984d3a3b4e1ec8522c224543046a7d8fdf0090af2

SHA512
67962f0976a16c4323d14d4f7f6fe23bf1145db115be59b25f8fdfbe49d2d0672ed868ce7d69cb33b790f50f37b1187d5bd64fddfeb20260c88d4c5f75be4a57

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3bcea99f8726e92c344d530c1fafdb1a

SHA1
01de46b9e78a2ed1696eb438de855dc9fb547e39

SHA256
afb8e0d02e25e23353dce6363c1ed9eda3505dfcb17c37cc1385b2138d4ebaa2

SHA512
6e5af2bedf27b9d272961342e788f530b9b1ebe6f7dd460ff7387407bda914d7a188af8e978003bc7bd971218d89b20fadb090d332a3ba8ab7e55c4c277543c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
c94af379fe0d2afdabe4476dc7232198

SHA1
ae6ebf37fd84cf66dcd330e998f972a4d0a21b72

SHA256
7a1017d506434a4bd30a8ab78c064881313d14d95bc8b4e13589824b4caf9a07

SHA512
80e112fe35b27c0e85b657ec158583faf742157f27e8ff00ea1e4f3d688ac173bd154bb0dec19aee43f7035c2b4b7156373a52f0642773dee0a01fcb37844144

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
120c6c9af4de2accfcff2ed8c3aab1af

SHA1
504f64ae4ac9c4fe308a6a50be24fe464f3dad95

SHA256
461315e4057c3fa4d0031df3f7e6511914f082698b6c41f5c2ada831ceffb222

SHA512
041712168718dff702da8203b4089b2e57db98ce503b8ecf36809dec0cd7a595a0d427caa960bc1bd29cbedc85ad3262773f2077a476b85aca387d48f7b07ba2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
120c6c9af4de2accfcff2ed8c3aab1af

SHA1
504f64ae4ac9c4fe308a6a50be24fe464f3dad95

SHA256
461315e4057c3fa4d0031df3f7e6511914f082698b6c41f5c2ada831ceffb222

SHA512
041712168718dff702da8203b4089b2e57db98ce503b8ecf36809dec0cd7a595a0d427caa960bc1bd29cbedc85ad3262773f2077a476b85aca387d48f7b07ba2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
50d3033f2bc3a3774c469d03e71a79a9

SHA1
22027b1d52085de99b3bffa276530fea5d961471

SHA256
2987e99ec7fa17bd4ab7de3cb4dc62645e1052012a5a357904d6fc6db9054147

SHA512
ecf7ab1a9e4192454a3e24c60453fd702a8c648e00078fc933b9182f4a3d3c10c6f5da622a5729b35727e6ddc8837029caddcaf76f56e805b9744253b56da5d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
60945d1a2e48da37d4ce8d9c56b6845a

SHA1
83e80a6acbeb44b68b0da00b139471f428a9d6c1

SHA256
314b91c00997034d6e015f40230d90ebbf57de5dc938b62c1a214d591793dbe3

SHA512
5d068f1d6443e26ae3cad1c80f969e50e5860967b314153c4d3b6efd1cfa39f0907c6427bec7fa43db079f258b6357e4e9a1b0b1a36b1481d2049ea0e67909ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
10890cda4b6eab618e926c4118ab0647

SHA1
1e1d63b73a0e6c7575f458b3c7917a9ce5ba776d

SHA256
00f8a035324d39bd62e6dee5e1b480069015471c487ebee4479e6990ea9ddb14

SHA512
a2ee84006c24a36f25e0bca0772430d64e3791f233da916aecdeae6712763e77d55bbbd00dc8f6b2b3887f3c26ab3980b96c5f46cc823e81e28abbbc5fc78221

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
83685d101174171875b4a603a6c2a35c

SHA1
37be24f7c4525e17fa18dbd004186be3a9209017

SHA256
0c557845aab1da497bbff0e8fbe65cabf4cb2804b97ba8ae8c695a528af70870

SHA512
005a97a8e07b1840abdcef86a7881fd9bdc8acbfdf3eafe1dceb6374060626d81d789e57d87ca4096a39e28d5cca00f8945edff0a747591691ae75873d2b3fb5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
10890cda4b6eab618e926c4118ab0647

SHA1
1e1d63b73a0e6c7575f458b3c7917a9ce5ba776d

SHA256
00f8a035324d39bd62e6dee5e1b480069015471c487ebee4479e6990ea9ddb14

SHA512
a2ee84006c24a36f25e0bca0772430d64e3791f233da916aecdeae6712763e77d55bbbd00dc8f6b2b3887f3c26ab3980b96c5f46cc823e81e28abbbc5fc78221

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
b51dc9e5ec3c97f72b4ca9488bbb4462

SHA1
5c1e8c0b728cd124edcacefb399bbd5e25b21bd3

SHA256
976f9534aa2976c85c2455bdde786a3f55d63aefdd40942eba1223c4c93590db

SHA512
0e5aa6cf64c535aefb833e5757b68e1094c87424abe2615a7d7d26b1b31eff358d12e36e75ca57fd690a9919b776600bf4c5c0e5a5df55366ba62238bdf3f280

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
ef72c47dbfaae0b9b0d09f22ad4afe20

SHA1
5357f66ba69b89440b99d4273b74221670129338

SHA256
692ec20c7039170fb199510f0436181fd155e6b4516d4d1c9e1675adf99aaa7f

SHA512
7514b6bc8dc39fa618223300be27cd535dc35b18c66b4a089e2302e72b3e0cac06d88a989fa1296feb386b3cbe2084019df6430c7f895071b76e04ce559a30b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
10890cda4b6eab618e926c4118ab0647

SHA1
1e1d63b73a0e6c7575f458b3c7917a9ce5ba776d

SHA256
00f8a035324d39bd62e6dee5e1b480069015471c487ebee4479e6990ea9ddb14

SHA512
a2ee84006c24a36f25e0bca0772430d64e3791f233da916aecdeae6712763e77d55bbbd00dc8f6b2b3887f3c26ab3980b96c5f46cc823e81e28abbbc5fc78221

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d3e8199b4634731cf0a0c26c1f14f588

SHA1
7f8fae27eb80055a436a6b5457978f32673d9ad4

SHA256
ef33f487f93c2977e92fb08d6bdcc9d48b5d1864c402f9d3fbf3e1b30e8b3b9a

SHA512
806a123100dbc1ca1b27bbad5b93c3a9a840dc795127af8523333a71259a8c5ef8aefccb83ef390f2644e013f138c4b7b63c584acccb197aada0c70c038032e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
9bc110200117a3752313ca2acaf8a9e1

SHA1
fda6b7da2e7b0175b391475ca78d1b4cf2147cd3

SHA256
c88e4bbb64f7fa31429ebe82c1cf07785c44486f37576f783a26ac856e02a4eb

SHA512
1f1af32aa18a8cbfcc65b0d4fb7e6ca2705f125eaa85789e981ee68b90c64522e954825abf460d4b4f97567715dfae8d9b0a25a4d54d10bc4c257c472f2e80fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e5663972c1caaba7088048911c758bf3

SHA1
3462dea0f9c2c16a9c3afdaef8bbb1f753c1c198

SHA256
9f7f29a4696876cadca3f14d7e43f9ede0c97fd64be3f5d94bda49a91b6a419e

SHA512
ff4e72c46cf083de62baa2ce2661555dd91b5f144294015f7b262fd4500cb67fe80e1871a82da63b607e3e9cef401f4b73c587bf1134637881ecad51aad1eddc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
83685d101174171875b4a603a6c2a35c

SHA1
37be24f7c4525e17fa18dbd004186be3a9209017

SHA256
0c557845aab1da497bbff0e8fbe65cabf4cb2804b97ba8ae8c695a528af70870

SHA512
005a97a8e07b1840abdcef86a7881fd9bdc8acbfdf3eafe1dceb6374060626d81d789e57d87ca4096a39e28d5cca00f8945edff0a747591691ae75873d2b3fb5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
ef72c47dbfaae0b9b0d09f22ad4afe20

SHA1
5357f66ba69b89440b99d4273b74221670129338

SHA256
692ec20c7039170fb199510f0436181fd155e6b4516d4d1c9e1675adf99aaa7f

SHA512
7514b6bc8dc39fa618223300be27cd535dc35b18c66b4a089e2302e72b3e0cac06d88a989fa1296feb386b3cbe2084019df6430c7f895071b76e04ce559a30b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
ce4540390cc4841c8973eb5a3e9f4f7d

SHA1
2293f30a6f4c9538bc5b06606c10a50ab4ecef8e

SHA256
e834e1da338b9644d538cefd70176768816da2556939c1255d386931bd085105

SHA512
2a3e466cb5a81d2b65256053b768a98321eb3e65ff46353eefc9864f14a391748116f050e7482ddd73a51575bf0a6fc5c673023dade62dbd8b174442bae1cc6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
9bc110200117a3752313ca2acaf8a9e1

SHA1
fda6b7da2e7b0175b391475ca78d1b4cf2147cd3

SHA256
c88e4bbb64f7fa31429ebe82c1cf07785c44486f37576f783a26ac856e02a4eb

SHA512
1f1af32aa18a8cbfcc65b0d4fb7e6ca2705f125eaa85789e981ee68b90c64522e954825abf460d4b4f97567715dfae8d9b0a25a4d54d10bc4c257c472f2e80fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
9bc110200117a3752313ca2acaf8a9e1

SHA1
fda6b7da2e7b0175b391475ca78d1b4cf2147cd3

SHA256
c88e4bbb64f7fa31429ebe82c1cf07785c44486f37576f783a26ac856e02a4eb

SHA512
1f1af32aa18a8cbfcc65b0d4fb7e6ca2705f125eaa85789e981ee68b90c64522e954825abf460d4b4f97567715dfae8d9b0a25a4d54d10bc4c257c472f2e80fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
9bc110200117a3752313ca2acaf8a9e1

SHA1
fda6b7da2e7b0175b391475ca78d1b4cf2147cd3

SHA256
c88e4bbb64f7fa31429ebe82c1cf07785c44486f37576f783a26ac856e02a4eb

SHA512
1f1af32aa18a8cbfcc65b0d4fb7e6ca2705f125eaa85789e981ee68b90c64522e954825abf460d4b4f97567715dfae8d9b0a25a4d54d10bc4c257c472f2e80fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
b4b6d4cc52b5a3a71149b1f33d94d5de

SHA1
97d3dbdd24919eab70e3b14c68797cefc07e90dd

SHA256
da8c02ce00d5b1e6d4c3667465c7bbc14d7cd5227eb634f3d9690afd488267fe

SHA512
fc894f03709b83df7d2fca2779e1e60549078b67bcdbff0b61c8e5a802982210ae971309c1f92577573299288963ab5c95c6b38cbaedf53dc6062812c57a97af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
60945d1a2e48da37d4ce8d9c56b6845a

SHA1
83e80a6acbeb44b68b0da00b139471f428a9d6c1

SHA256
314b91c00997034d6e015f40230d90ebbf57de5dc938b62c1a214d591793dbe3

SHA512
5d068f1d6443e26ae3cad1c80f969e50e5860967b314153c4d3b6efd1cfa39f0907c6427bec7fa43db079f258b6357e4e9a1b0b1a36b1481d2049ea0e67909ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
5cfe303e798d1cc6c1dab341e7265c15

SHA1
cd2834e05191a24e28a100f3f8114d5a7708dc7c

SHA256
c4d16552769ca1762f6867bce85589c645ac3dc490b650083d74f853f898cfab

SHA512
ef151bbe0033a2caf2d40aff74855a3f42c8171e05a11c8ce93c7039d9430482c43fe93d9164ee94839aff253cad774dbf619dde9a8af38773ca66d59ac3400e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
eaf2949b53de8c4a84042633ab9545d4

SHA1
882fa652ca3ca05f93f383057b9937cf8bff704e

SHA256
42e02d0d8a7ea1446fadc3a43297652904bb326b3d2d961d83783fb0b47d3d50

SHA512
5da2d97fe178b9764c51599f1410f0bb41f5bd7dd37b027f00b378a5d12be57b72dcf9e4800e765384fbf17c784876b5783b08fa940d1db44cfb928ea391bb00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
1226cbe1b9180c106bb1c6df4c56e023

SHA1
b42e0f4e40a8713c0300a8852d7c2a5690e03bbc

SHA256
413900875971fd21b31b0613362ef890e03901dca5bc6d9a2754bf5358d92a7f

SHA512
01caa250c5a3d68cd6dfb9ab3d97c6681aa3f004f1a23fb64dccc74c509a4c6a65fdc7c26d55ff84c1f5d34a91193b697f0834be6059c9bb381c5209033f75bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
aba273eeba4876ea41ee0e64b4cbb51d

SHA1
bef5f75b81cf27268dc0d0f30f00b022f9288db9

SHA256
67fc3f5c3407858793c6fac6131b0f340667ffc567fa76b43245ecf2621322c9

SHA512
23dc2f0cfc68194dcbf407a6528cf9f9a8aa89f4821be22413bde036ae5ca44144b568aa3160372b9741f3d0f5baa48dff8a8b582bdedc3ad3fb121af340c0ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_a11w0ovk.va2.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\https_payload_ngrok_outfile.ps1

Filesize
6B

MD5
bea07e6d2b8dce396fe21baa61b34956

SHA1
665332b36fc8fa1ed11210cdee83b639b451e592

SHA256
2e08d1f6000aef541797d008c05ac36f4dbebfb36cbac5615788e6fcc5b300a7

SHA512
4ad82fbef6d8d3f4d0b90a9399c8b405674bad0c750e385fb034e57895838fd26d7926f6ed0ccab2e2afcaf4a23613ed8f16d909bff870b40187e22e0a6362c1

Download Submit
memory/676-164-0x0000012352DD0000-0x0000012352DE0000-memory.dmp

Filesize
64KB

Download
memory/676-171-0x00007FFFA3900000-0x00007FFFA43C1000-memory.dmp

Filesize
10.8MB

Download
memory/676-158-0x0000012352DD0000-0x0000012352DE0000-memory.dmp

Filesize
64KB

Download
memory/676-157-0x00007FFFA3900000-0x00007FFFA43C1000-memory.dmp

Filesize
10.8MB

Download
memory/688-10-0x00007FFFA3900000-0x00007FFFA43C1000-memory.dmp

Filesize
10.8MB

Download
memory/688-52-0x000002E88B7A0000-0x000002E88B7B0000-memory.dmp

Filesize
64KB

Download
memory/688-48-0x000002E88B7A0000-0x000002E88B7B0000-memory.dmp

Filesize
64KB

Download
memory/688-47-0x000002E88B7A0000-0x000002E88B7B0000-memory.dmp

Filesize
64KB

Download
memory/688-44-0x00007FFFA3900000-0x00007FFFA43C1000-memory.dmp

Filesize
10.8MB

Download
memory/688-13-0x000002E88B7A0000-0x000002E88B7B0000-memory.dmp

Filesize
64KB

Download
memory/688-11-0x000002E88B7A0000-0x000002E88B7B0000-memory.dmp

Filesize
64KB

Download
memory/688-12-0x000002E88B7A0000-0x000002E88B7B0000-memory.dmp

Filesize
64KB

Download
memory/688-9-0x000002E88D160000-0x000002E88D182000-memory.dmp

Filesize
136KB

Download
memory/2168-88-0x00007FFFA3900000-0x00007FFFA43C1000-memory.dmp

Filesize
10.8MB

Download
memory/2168-99-0x000002A36DC50000-0x000002A36DC60000-memory.dmp

Filesize
64KB

Download
memory/2168-98-0x000002A36DC50000-0x000002A36DC60000-memory.dmp

Filesize
64KB

Download
memory/2168-101-0x000002A36DC50000-0x000002A36DC60000-memory.dmp

Filesize
64KB

Download
memory/2168-103-0x00007FFFA3900000-0x00007FFFA43C1000-memory.dmp

Filesize
10.8MB

Download
memory/2456-46-0x000001FE60470000-0x000001FE60480000-memory.dmp

Filesize
64KB

Download
memory/2456-32-0x00007FFFA3900000-0x00007FFFA43C1000-memory.dmp

Filesize
10.8MB

Download
memory/2456-38-0x000001FE60470000-0x000001FE60480000-memory.dmp

Filesize
64KB

Download
memory/2456-50-0x00007FFFA3900000-0x00007FFFA43C1000-memory.dmp

Filesize
10.8MB

Download
memory/2456-45-0x000001FE60470000-0x000001FE60480000-memory.dmp

Filesize
64KB

Download
memory/3028-138-0x00007FFFA3900000-0x00007FFFA43C1000-memory.dmp

Filesize
10.8MB

Download
memory/3028-136-0x00000263A8300000-0x00000263A8310000-memory.dmp

Filesize
64KB

Download
memory/3028-135-0x00000263A8300000-0x00000263A8310000-memory.dmp

Filesize
64KB

Download
memory/3028-134-0x00000263A8300000-0x00000263A8310000-memory.dmp

Filesize
64KB

Download
memory/3028-133-0x00000263A8300000-0x00000263A8310000-memory.dmp

Filesize
64KB

Download
memory/3028-127-0x00007FFFA3900000-0x00007FFFA43C1000-memory.dmp

Filesize
10.8MB

Download
memory/3332-69-0x00007FFFA3900000-0x00007FFFA43C1000-memory.dmp

Filesize
10.8MB

Download
memory/3332-61-0x00007FFFA3900000-0x00007FFFA43C1000-memory.dmp

Filesize
10.8MB

Download
memory/3332-64-0x000001EFCDEA0000-0x000001EFCDEB0000-memory.dmp

Filesize
64KB

Download
memory/3332-66-0x000001EFCDEA0000-0x000001EFCDEB0000-memory.dmp

Filesize
64KB

Download
memory/3332-63-0x000001EFCDEA0000-0x000001EFCDEB0000-memory.dmp

Filesize
64KB

Download
memory/3332-67-0x000001EFCDEA0000-0x000001EFCDEB0000-memory.dmp

Filesize
64KB

Download
memory/3472-199-0x00007FFFA3900000-0x00007FFFA43C1000-memory.dmp

Filesize
10.8MB

Download
memory/3472-202-0x0000016C29160000-0x0000016C29170000-memory.dmp

Filesize
64KB

Download
memory/3472-203-0x0000016C29160000-0x0000016C29170000-memory.dmp

Filesize
64KB

Download
memory/3472-201-0x0000016C29160000-0x0000016C29170000-memory.dmp

Filesize
64KB

Download
memory/3472-204-0x0000016C29160000-0x0000016C29170000-memory.dmp

Filesize
64KB

Download
memory/3852-80-0x00007FFFA3900000-0x00007FFFA43C1000-memory.dmp

Filesize
10.8MB

Download
memory/3852-86-0x00007FFFA3900000-0x00007FFFA43C1000-memory.dmp

Filesize
10.8MB

Download
memory/3852-84-0x000001FFB9190000-0x000001FFB91A0000-memory.dmp

Filesize
64KB

Download
memory/3852-82-0x000001FFB9190000-0x000001FFB91A0000-memory.dmp

Filesize
64KB

Download
memory/3852-83-0x000001FFB9190000-0x000001FFB91A0000-memory.dmp

Filesize
64KB

Download
memory/4448-15-0x00007FFFA3900000-0x00007FFFA43C1000-memory.dmp

Filesize
10.8MB

Download
memory/4448-25-0x000001FC09B80000-0x000001FC09B90000-memory.dmp

Filesize
64KB

Download
memory/4448-26-0x000001FC09B80000-0x000001FC09B90000-memory.dmp

Filesize
64KB

Download
memory/4448-29-0x00007FFFA3900000-0x00007FFFA43C1000-memory.dmp

Filesize
10.8MB

Download
memory/4460-120-0x00007FFFA3900000-0x00007FFFA43C1000-memory.dmp

Filesize
10.8MB

Download
memory/4460-117-0x0000022FAC3A0000-0x0000022FAC3B0000-memory.dmp

Filesize
64KB

Download
memory/4460-114-0x00007FFFA3900000-0x00007FFFA43C1000-memory.dmp

Filesize
10.8MB

Download
memory/4460-115-0x0000022FAC3A0000-0x0000022FAC3B0000-memory.dmp

Filesize
64KB

Download
memory/4460-118-0x0000022FAC3A0000-0x0000022FAC3B0000-memory.dmp

Filesize
64KB

Download
memory/4528-149-0x00007FFFA3900000-0x00007FFFA43C1000-memory.dmp

Filesize
10.8MB

Download
memory/4528-150-0x000001E5BF490000-0x000001E5BF4A0000-memory.dmp

Filesize
64KB

Download
memory/4528-152-0x000001E5BF490000-0x000001E5BF4A0000-memory.dmp

Filesize
64KB

Download
memory/4528-153-0x000001E5BF490000-0x000001E5BF4A0000-memory.dmp

Filesize
64KB

Download
memory/4528-155-0x00007FFFA3900000-0x00007FFFA43C1000-memory.dmp

Filesize
10.8MB

Download
memory/5004-188-0x00007FFFA3900000-0x00007FFFA43C1000-memory.dmp

Filesize
10.8MB

Download
memory/5004-182-0x000002038CA10000-0x000002038CA20000-memory.dmp

Filesize
64KB

Download
memory/5004-173-0x00007FFFA3900000-0x00007FFFA43C1000-memory.dmp

Filesize
10.8MB

Download
memory/5004-184-0x000002038CA10000-0x000002038CA20000-memory.dmp

Filesize
64KB

Download
memory/5004-186-0x000002038CA10000-0x000002038CA20000-memory.dmp

Filesize
64KB

Download