formbook | 8349d0c4d9914eeb0d1619a23d5bfe062d00f94e64883483d12b0054d27ac376

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
18/07/2023, 06:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Ziraat Bankasi Swift Mesaji.exe
Size

161KB
MD5

802b5fe7efa993985e56f6636c0c8cca
SHA1

e53a075410bfa5d505ea6663e2b04adf3dd7ef09
SHA256

8349d0c4d9914eeb0d1619a23d5bfe062d00f94e64883483d12b0054d27ac376
SHA512

14f06896f8e264bd05e18ddf5d1551a3ec8cc0da40ea84448c9f0ae3d9ec094c5b7f11157e9444455f04c49c15443005e870de3cef8b182ca5e4041125baed84
SSDEEP

3072:+NzPHk9MpcQbhPjOKlkITN9lgNZXOXcSdfcLP66o3DuxDgKbxjVvdEd63Q21zo+y:+hRFh757TmcNfa2zgDgKdVCQhy

Score

10^/10

formbook my26 discovery rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

my26

Decoy

hqe0aw.cfd

kompromat1.life

cruises-62138.bond

servru.fun

019469.com

nelcorgold.com

tscauknf2.com

satset5.shop

kraflex.net

indoxl.city

jcm-54.com

wantedleds.shop

vzuqiiud.cfd

filipe.works

vistservice.online

bjnyfjef.cfd

thegolffund.com

hadyjayapropertindo.com

passionalchemy.com

k9eiow.cfd

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 4 IoCs

rat

resource	yara_rule
behavioral2/memory/3004-1108-0x0000000000400000-0x0000000001654000-memory.dmp	formbook
behavioral2/memory/3004-1111-0x0000000000400000-0x0000000001654000-memory.dmp	formbook
behavioral2/memory/4716-1117-0x0000000000560000-0x000000000058F000-memory.dmp	formbook
behavioral2/memory/4716-1122-0x0000000000560000-0x000000000058F000-memory.dmp	formbook

Checks QEMU agent file 2 TTPs 2 IoCs

Checks presence of QEMU agent, possibly to detect virtualization.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	Ziraat Bankasi Swift Mesaji.exe
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	Ziraat Bankasi Swift Mesaji.exe

Loads dropped DLL 64 IoCs

pid	Process
4460	Ziraat Bankasi Swift Mesaji.exe
4460	Ziraat Bankasi Swift Mesaji.exe
4460	Ziraat Bankasi Swift Mesaji.exe
4460	Ziraat Bankasi Swift Mesaji.exe
4460	Ziraat Bankasi Swift Mesaji.exe
4460	Ziraat Bankasi Swift Mesaji.exe
4460	Ziraat Bankasi Swift Mesaji.exe
4460	Ziraat Bankasi Swift Mesaji.exe
4460	Ziraat Bankasi Swift Mesaji.exe
4460	Ziraat Bankasi Swift Mesaji.exe
4460	Ziraat Bankasi Swift Mesaji.exe
4460	Ziraat Bankasi Swift Mesaji.exe
4460	Ziraat Bankasi Swift Mesaji.exe
4460	Ziraat Bankasi Swift Mesaji.exe
4460	Ziraat Bankasi Swift Mesaji.exe
4460	Ziraat Bankasi Swift Mesaji.exe
4460	Ziraat Bankasi Swift Mesaji.exe
4460	Ziraat Bankasi Swift Mesaji.exe
4460	Ziraat Bankasi Swift Mesaji.exe
4460	Ziraat Bankasi Swift Mesaji.exe
4460	Ziraat Bankasi Swift Mesaji.exe
4460	Ziraat Bankasi Swift Mesaji.exe
4460	Ziraat Bankasi Swift Mesaji.exe
4460	Ziraat Bankasi Swift Mesaji.exe
4460	Ziraat Bankasi Swift Mesaji.exe
4460	Ziraat Bankasi Swift Mesaji.exe
4460	Ziraat Bankasi Swift Mesaji.exe
4460	Ziraat Bankasi Swift Mesaji.exe
4460	Ziraat Bankasi Swift Mesaji.exe
4460	Ziraat Bankasi Swift Mesaji.exe
4460	Ziraat Bankasi Swift Mesaji.exe
4460	Ziraat Bankasi Swift Mesaji.exe
4460	Ziraat Bankasi Swift Mesaji.exe
4460	Ziraat Bankasi Swift Mesaji.exe
4460	Ziraat Bankasi Swift Mesaji.exe
4460	Ziraat Bankasi Swift Mesaji.exe
4460	Ziraat Bankasi Swift Mesaji.exe
4460	Ziraat Bankasi Swift Mesaji.exe
4460	Ziraat Bankasi Swift Mesaji.exe
4460	Ziraat Bankasi Swift Mesaji.exe
4460	Ziraat Bankasi Swift Mesaji.exe
4460	Ziraat Bankasi Swift Mesaji.exe
4460	Ziraat Bankasi Swift Mesaji.exe
4460	Ziraat Bankasi Swift Mesaji.exe
4460	Ziraat Bankasi Swift Mesaji.exe
4460	Ziraat Bankasi Swift Mesaji.exe
4460	Ziraat Bankasi Swift Mesaji.exe
4460	Ziraat Bankasi Swift Mesaji.exe
4460	Ziraat Bankasi Swift Mesaji.exe
4460	Ziraat Bankasi Swift Mesaji.exe
4460	Ziraat Bankasi Swift Mesaji.exe
4460	Ziraat Bankasi Swift Mesaji.exe
4460	Ziraat Bankasi Swift Mesaji.exe
4460	Ziraat Bankasi Swift Mesaji.exe
4460	Ziraat Bankasi Swift Mesaji.exe
4460	Ziraat Bankasi Swift Mesaji.exe
4460	Ziraat Bankasi Swift Mesaji.exe
4460	Ziraat Bankasi Swift Mesaji.exe
4460	Ziraat Bankasi Swift Mesaji.exe
4460	Ziraat Bankasi Swift Mesaji.exe
4460	Ziraat Bankasi Swift Mesaji.exe
4460	Ziraat Bankasi Swift Mesaji.exe
4460	Ziraat Bankasi Swift Mesaji.exe
4460	Ziraat Bankasi Swift Mesaji.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
3004	Ziraat Bankasi Swift Mesaji.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
4460	Ziraat Bankasi Swift Mesaji.exe
3004	Ziraat Bankasi Swift Mesaji.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 4460 set thread context of 3004	4460	Ziraat Bankasi Swift Mesaji.exe	685
PID 3004 set thread context of 680	3004	Ziraat Bankasi Swift Mesaji.exe	39
PID 4716 set thread context of 680	4716	wscript.exe	39

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\unbarren\Stropper\simlens\Argumentationers.ini	Ziraat Bankasi Swift Mesaji.exe
File opened for modification	C:\Program Files (x86)\coccidae.und	Ziraat Bankasi Swift Mesaji.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\drmmetanke\Wepmankin69\Philotheistic109.tom	Ziraat Bankasi Swift Mesaji.exe
File opened for modification	C:\Windows\resources\0409\sabbataftnernes.Rid37	Ziraat Bankasi Swift Mesaji.exe
File opened for modification	C:\Windows\resources\emaculate\vug\blastocoelic.Trs	Ziraat Bankasi Swift Mesaji.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
3004	Ziraat Bankasi Swift Mesaji.exe
3004	Ziraat Bankasi Swift Mesaji.exe
3004	Ziraat Bankasi Swift Mesaji.exe
3004	Ziraat Bankasi Swift Mesaji.exe
4716	wscript.exe
4716	wscript.exe
4716	wscript.exe
4716	wscript.exe
4716	wscript.exe
4716	wscript.exe
4716	wscript.exe
4716	wscript.exe
4716	wscript.exe
4716	wscript.exe
4716	wscript.exe
4716	wscript.exe
4716	wscript.exe
4716	wscript.exe
4716	wscript.exe
4716	wscript.exe
4716	wscript.exe
4716	wscript.exe
4716	wscript.exe
4716	wscript.exe
4716	wscript.exe
4716	wscript.exe
4716	wscript.exe
4716	wscript.exe
4716	wscript.exe
4716	wscript.exe
4716	wscript.exe
4716	wscript.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
680	Explorer.EXE

Suspicious behavior: MapViewOfSection 6 IoCs

pid	Process
4460	Ziraat Bankasi Swift Mesaji.exe
3004	Ziraat Bankasi Swift Mesaji.exe
3004	Ziraat Bankasi Swift Mesaji.exe
3004	Ziraat Bankasi Swift Mesaji.exe
4716	wscript.exe
4716	wscript.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	3004	Ziraat Bankasi Swift Mesaji.exe
Token: SeShutdownPrivilege	680	Explorer.EXE
Token: SeCreatePagefilePrivilege	680	Explorer.EXE
Token: SeShutdownPrivilege	680	Explorer.EXE
Token: SeCreatePagefilePrivilege	680	Explorer.EXE
Token: SeDebugPrivilege	4716	wscript.exe
Token: SeShutdownPrivilege	680	Explorer.EXE
Token: SeCreatePagefilePrivilege	680	Explorer.EXE
Token: SeShutdownPrivilege	680	Explorer.EXE
Token: SeCreatePagefilePrivilege	680	Explorer.EXE

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
680	Explorer.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4460 wrote to memory of 4056	4460	Ziraat Bankasi Swift Mesaji.exe	86
PID 4460 wrote to memory of 4056	4460	Ziraat Bankasi Swift Mesaji.exe	86
PID 4460 wrote to memory of 4056	4460	Ziraat Bankasi Swift Mesaji.exe	86
PID 4460 wrote to memory of 1788	4460	Ziraat Bankasi Swift Mesaji.exe	88
PID 4460 wrote to memory of 1788	4460	Ziraat Bankasi Swift Mesaji.exe	88
PID 4460 wrote to memory of 1788	4460	Ziraat Bankasi Swift Mesaji.exe	88
PID 4460 wrote to memory of 2304	4460	Ziraat Bankasi Swift Mesaji.exe	90
PID 4460 wrote to memory of 2304	4460	Ziraat Bankasi Swift Mesaji.exe	90
PID 4460 wrote to memory of 2304	4460	Ziraat Bankasi Swift Mesaji.exe	90
PID 4460 wrote to memory of 3732	4460	Ziraat Bankasi Swift Mesaji.exe	92
PID 4460 wrote to memory of 3732	4460	Ziraat Bankasi Swift Mesaji.exe	92
PID 4460 wrote to memory of 3732	4460	Ziraat Bankasi Swift Mesaji.exe	92
PID 4460 wrote to memory of 1236	4460	Ziraat Bankasi Swift Mesaji.exe	94
PID 4460 wrote to memory of 1236	4460	Ziraat Bankasi Swift Mesaji.exe	94
PID 4460 wrote to memory of 1236	4460	Ziraat Bankasi Swift Mesaji.exe	94
PID 4460 wrote to memory of 4404	4460	Ziraat Bankasi Swift Mesaji.exe	96
PID 4460 wrote to memory of 4404	4460	Ziraat Bankasi Swift Mesaji.exe	96
PID 4460 wrote to memory of 4404	4460	Ziraat Bankasi Swift Mesaji.exe	96
PID 4460 wrote to memory of 2040	4460	Ziraat Bankasi Swift Mesaji.exe	98
PID 4460 wrote to memory of 2040	4460	Ziraat Bankasi Swift Mesaji.exe	98
PID 4460 wrote to memory of 2040	4460	Ziraat Bankasi Swift Mesaji.exe	98
PID 4460 wrote to memory of 1940	4460	Ziraat Bankasi Swift Mesaji.exe	100
PID 4460 wrote to memory of 1940	4460	Ziraat Bankasi Swift Mesaji.exe	100
PID 4460 wrote to memory of 1940	4460	Ziraat Bankasi Swift Mesaji.exe	100
PID 4460 wrote to memory of 3952	4460	Ziraat Bankasi Swift Mesaji.exe	102
PID 4460 wrote to memory of 3952	4460	Ziraat Bankasi Swift Mesaji.exe	102
PID 4460 wrote to memory of 3952	4460	Ziraat Bankasi Swift Mesaji.exe	102
PID 4460 wrote to memory of 4736	4460	Ziraat Bankasi Swift Mesaji.exe	104
PID 4460 wrote to memory of 4736	4460	Ziraat Bankasi Swift Mesaji.exe	104
PID 4460 wrote to memory of 4736	4460	Ziraat Bankasi Swift Mesaji.exe	104
PID 4460 wrote to memory of 3504	4460	Ziraat Bankasi Swift Mesaji.exe	106
PID 4460 wrote to memory of 3504	4460	Ziraat Bankasi Swift Mesaji.exe	106
PID 4460 wrote to memory of 3504	4460	Ziraat Bankasi Swift Mesaji.exe	106
PID 4460 wrote to memory of 1992	4460	Ziraat Bankasi Swift Mesaji.exe	108
PID 4460 wrote to memory of 1992	4460	Ziraat Bankasi Swift Mesaji.exe	108
PID 4460 wrote to memory of 1992	4460	Ziraat Bankasi Swift Mesaji.exe	108
PID 4460 wrote to memory of 4428	4460	Ziraat Bankasi Swift Mesaji.exe	110
PID 4460 wrote to memory of 4428	4460	Ziraat Bankasi Swift Mesaji.exe	110
PID 4460 wrote to memory of 4428	4460	Ziraat Bankasi Swift Mesaji.exe	110
PID 4460 wrote to memory of 5036	4460	Ziraat Bankasi Swift Mesaji.exe	115
PID 4460 wrote to memory of 5036	4460	Ziraat Bankasi Swift Mesaji.exe	115
PID 4460 wrote to memory of 5036	4460	Ziraat Bankasi Swift Mesaji.exe	115
PID 4460 wrote to memory of 496	4460	Ziraat Bankasi Swift Mesaji.exe	117
PID 4460 wrote to memory of 496	4460	Ziraat Bankasi Swift Mesaji.exe	117
PID 4460 wrote to memory of 496	4460	Ziraat Bankasi Swift Mesaji.exe	117
PID 4460 wrote to memory of 4568	4460	Ziraat Bankasi Swift Mesaji.exe	119
PID 4460 wrote to memory of 4568	4460	Ziraat Bankasi Swift Mesaji.exe	119
PID 4460 wrote to memory of 4568	4460	Ziraat Bankasi Swift Mesaji.exe	119
PID 4460 wrote to memory of 3172	4460	Ziraat Bankasi Swift Mesaji.exe	122
PID 4460 wrote to memory of 3172	4460	Ziraat Bankasi Swift Mesaji.exe	122
PID 4460 wrote to memory of 3172	4460	Ziraat Bankasi Swift Mesaji.exe	122
PID 4460 wrote to memory of 1788	4460	Ziraat Bankasi Swift Mesaji.exe	124
PID 4460 wrote to memory of 1788	4460	Ziraat Bankasi Swift Mesaji.exe	124
PID 4460 wrote to memory of 1788	4460	Ziraat Bankasi Swift Mesaji.exe	124
PID 4460 wrote to memory of 3176	4460	Ziraat Bankasi Swift Mesaji.exe	126
PID 4460 wrote to memory of 3176	4460	Ziraat Bankasi Swift Mesaji.exe	126
PID 4460 wrote to memory of 3176	4460	Ziraat Bankasi Swift Mesaji.exe	126
PID 4460 wrote to memory of 2204	4460	Ziraat Bankasi Swift Mesaji.exe	128
PID 4460 wrote to memory of 2204	4460	Ziraat Bankasi Swift Mesaji.exe	128
PID 4460 wrote to memory of 2204	4460	Ziraat Bankasi Swift Mesaji.exe	128
PID 4460 wrote to memory of 4888	4460	Ziraat Bankasi Swift Mesaji.exe	131
PID 4460 wrote to memory of 4888	4460	Ziraat Bankasi Swift Mesaji.exe	131
PID 4460 wrote to memory of 4888	4460	Ziraat Bankasi Swift Mesaji.exe	131
PID 4460 wrote to memory of 4728	4460	Ziraat Bankasi Swift Mesaji.exe	133

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
PID:680
- C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe
  "C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe"
  2⤵
  - Checks QEMU agent file
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:4460
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "250^177"
    3⤵
    PID:4056
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "244^177"
    3⤵
    PID:1788
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "227^177"
    3⤵
    PID:2304
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "255^177"
    3⤵
    PID:3732
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "244^177"
    3⤵
    PID:1236
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "253^177"
    3⤵
    PID:4404
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "130^177"
    3⤵
    PID:2040
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "131^177"
    3⤵
    PID:1940
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "139^177"
    3⤵
    PID:3952
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "139^177"
    3⤵
    PID:4736
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "242^177"
    3⤵
    PID:3504
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "195^177"
    3⤵
    PID:1992
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "212^177"
    3⤵
    PID:4428
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "208^177"
    3⤵
    PID:5036
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "197^177"
    3⤵
    PID:496
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "212^177"
    3⤵
    PID:4568
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "247^177"
    3⤵
    PID:3172
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "216^177"
    3⤵
    PID:1788
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "221^177"
    3⤵
    PID:3176
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "212^177"
    3⤵
    PID:2204
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "240^177"
    3⤵
    PID:4888
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "153^177"
    3⤵
    PID:4728
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "220^177"
    3⤵
    PID:1092
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "145^177"
    3⤵
    PID:448
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "195^177"
    3⤵
    PID:2924
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "133^177"
    3⤵
    PID:1432
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "145^177"
    3⤵
    PID:4388
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "157^177"
    3⤵
    PID:4408
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "145^177"
    3⤵
    PID:488
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "216^177"
    3⤵
    PID:3764
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "145^177"
    3⤵
    PID:3944
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "129^177"
    3⤵
    PID:1528
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "201^177"
    3⤵
    PID:1508
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "137^177"
    3⤵
    PID:2508
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "129^177"
    3⤵
    PID:4404
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "129^177"
    3⤵
    PID:3824
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "129^177"
    3⤵
    PID:3548
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "129^177"
    3⤵
    PID:2496
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "129^177"
    3⤵
    PID:4080
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "129^177"
    3⤵
    PID:2256
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "129^177"
    3⤵
    PID:4400
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "157^177"
    3⤵
    PID:4428
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "145^177"
    3⤵
    PID:4928
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "216^177"
    3⤵
    PID:3696
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "145^177"
    3⤵
    PID:1892
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "129^177"
    3⤵
    PID:4144
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "157^177"
    3⤵
    PID:4972
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "145^177"
    3⤵
    PID:4272
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "193^177"
    3⤵
    PID:4332
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "145^177"
    3⤵
    PID:3860
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "129^177"
    3⤵
    PID:1416
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "157^177"
    3⤵
    PID:2468
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "145^177"
    3⤵
    PID:2300
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "216^177"
    3⤵
    PID:3648
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "145^177"
    3⤵
    PID:1212
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "133^177"
    3⤵
    PID:4432
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "157^177"
    3⤵
    PID:4736
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "145^177"
    3⤵
    PID:4788
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "216^177"
    3⤵
    PID:4264
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "145^177"
    3⤵
    PID:1648
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "129^177"
    3⤵
    PID:2396
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "201^177"
    3⤵
    PID:4508
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "137^177"
    3⤵
    PID:2412
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "129^177"
    3⤵
    PID:4100
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "157^177"
    3⤵
    PID:1368
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "145^177"
    3⤵
    PID:640
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "216^177"
    3⤵
    PID:4176
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "145^177"
    3⤵
    PID:2176
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "129^177"
    3⤵
    PID:3644
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "152^177"
    3⤵
    PID:3252
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "216^177"
    3⤵
    PID:3040
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "159^177"
    3⤵
    PID:3548
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "195^177"
    3⤵
    PID:3160
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "132^177"
    3⤵
    PID:924
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "141^177"
    3⤵
    PID:2924
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "250^177"
    3⤵
    PID:1784
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "244^177"
    3⤵
    PID:4208
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "227^177"
    3⤵
    PID:2720
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "255^177"
    3⤵
    PID:1564
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "244^177"
    3⤵
    PID:1828
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "253^177"
    3⤵
    PID:2836
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "130^177"
    3⤵
    PID:5008
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "131^177"
    3⤵
    PID:3888
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "139^177"
    3⤵
    PID:2948
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "139^177"
    3⤵
    PID:4008
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "231^177"
    3⤵
    PID:2832
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "216^177"
    3⤵
    PID:1440
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "195^177"
    3⤵
    PID:964
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "197^177"
    3⤵
    PID:1940
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "196^177"
    3⤵
    PID:4312
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "208^177"
    3⤵
    PID:920
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "221^177"
    3⤵
    PID:3620
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "240^177"
    3⤵
    PID:2936
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "221^177"
    3⤵
    PID:4428
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "221^177"
    3⤵
    PID:4124
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "222^177"
    3⤵
    PID:1008
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "210^177"
    3⤵
    PID:1220
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "153^177"
    3⤵
    PID:3104
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "216^177"
    3⤵
    PID:4136
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "145^177"
    3⤵
    PID:3888
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "129^177"
    3⤵
    PID:4752
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "157^177"
    3⤵
    PID:3388
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "216^177"
    3⤵
    PID:3808
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "145^177"
    3⤵
    PID:2716
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "135^177"
    3⤵
    PID:4596
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "132^177"
    3⤵
    PID:3476
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "137^177"
    3⤵
    PID:2516
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "134^177"
    3⤵
    PID:2608
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "132^177"
    3⤵
    PID:4080
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "136^177"
    3⤵
    PID:4516
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "135^177"
    3⤵
    PID:4388
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "137^177"
    3⤵
    PID:4996
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "157^177"
    3⤵
    PID:1892
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "145^177"
    3⤵
    PID:2412
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "216^177"
    3⤵
    PID:3976
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "145^177"
    3⤵
    PID:2860
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "129^177"
    3⤵
    PID:640
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "201^177"
    3⤵
    PID:1980
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "130^177"
    3⤵
    PID:2344
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "129^177"
    3⤵
    PID:4104
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "129^177"
    3⤵
    PID:1152
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "129^177"
    3⤵
    PID:2832
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "157^177"
    3⤵
    PID:3540
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "145^177"
    3⤵
    PID:3040
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "216^177"
    3⤵
    PID:2260
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "145^177"
    3⤵
    PID:3028
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "129^177"
    3⤵
    PID:4172
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "201^177"
    3⤵
    PID:4924
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "133^177"
    3⤵
    PID:1784
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "129^177"
    3⤵
    PID:5088
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "152^177"
    3⤵
    PID:4996
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "193^177"
    3⤵
    PID:1892
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "159^177"
    3⤵
    PID:2412
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "195^177"
    3⤵
    PID:3976
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "128^177"
    3⤵
    PID:2860
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "141^177"
    3⤵
    PID:3732
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "250^177"
    3⤵
    PID:1980
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "244^177"
    3⤵
    PID:2344
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "227^177"
    3⤵
    PID:4104
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "255^177"
    3⤵
    PID:1152
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "244^177"
    3⤵
    PID:2832
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "253^177"
    3⤵
    PID:3132
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "130^177"
    3⤵
    PID:1692
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "131^177"
    3⤵
    PID:3524
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "139^177"
    3⤵
    PID:4664
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "139^177"
    3⤵
    PID:4732
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "226^177"
    3⤵
    PID:4548
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "212^177"
    3⤵
    PID:2936
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "197^177"
    3⤵
    PID:4208
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "247^177"
    3⤵
    PID:4996
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "216^177"
    3⤵
    PID:1892
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "221^177"
    3⤵
    PID:2412
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "212^177"
    3⤵
    PID:3976
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "225^177"
    3⤵
    PID:2860
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "222^177"
    3⤵
    PID:3888
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "216^177"
    3⤵
    PID:4752
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "223^177"
    3⤵
    PID:3520
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "197^177"
    3⤵
    PID:2124
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "212^177"
    3⤵
    PID:1388
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "195^177"
    3⤵
    PID:2828
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "153^177"
    3⤵
    PID:2052
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "216^177"
    3⤵
    PID:4228
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "145^177"
    3⤵
    PID:3336
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "195^177"
    3⤵
    PID:1992
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "132^177"
    3⤵
    PID:752
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "157^177"
    3⤵
    PID:3964
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "145^177"
    3⤵
    PID:1408
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "216^177"
    3⤵
    PID:4860
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "145^177"
    3⤵
    PID:3820
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "135^177"
    3⤵
    PID:852
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "134^177"
    3⤵
    PID:5008
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "134^177"
    3⤵
    PID:4620
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "145^177"
    3⤵
    PID:3024
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "157^177"
    3⤵
    PID:1980
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "145^177"
    3⤵
    PID:412
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "216^177"
    3⤵
    PID:4340
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "145^177"
    3⤵
    PID:4268
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "129^177"
    3⤵
    PID:2832
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "157^177"
    3⤵
    PID:1156
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "216^177"
    3⤵
    PID:1692
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "145^177"
    3⤵
    PID:4668
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "129^177"
    3⤵
    PID:4664
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "152^177"
    3⤵
    PID:1864
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "216^177"
    3⤵
    PID:4548
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "159^177"
    3⤵
    PID:2936
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "195^177"
    3⤵
    PID:5088
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "130^177"
    3⤵
    PID:1316
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "141^177"
    3⤵
    PID:636
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "250^177"
    3⤵
    PID:4056
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "244^177"
    3⤵
    PID:2232
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "227^177"
    3⤵
    PID:2304
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "255^177"
    3⤵
    PID:3888
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "244^177"
    3⤵
    PID:2020
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "253^177"
    3⤵
    PID:2508
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "130^177"
    3⤵
    PID:2316
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "131^177"
    3⤵
    PID:1228
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "139^177"
    3⤵
    PID:2516
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "139^177"
    3⤵
    PID:4932
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "227^177"
    3⤵
    PID:4160
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "212^177"
    3⤵
    PID:5076
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "208^177"
    3⤵
    PID:4732
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "213^177"
    3⤵
    PID:4388
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "247^177"
    3⤵
    PID:392
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "216^177"
    3⤵
    PID:1968
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "221^177"
    3⤵
    PID:3820
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "212^177"
    3⤵
    PID:3172
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "153^177"
    3⤵
    PID:440
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "216^177"
    3⤵
    PID:2232
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "145^177"
    3⤵
    PID:1512
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "195^177"
    3⤵
    PID:4752
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "132^177"
    3⤵
    PID:4888
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "157^177"
    3⤵
    PID:5012
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "145^177"
    3⤵
    PID:3824
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "216^177"
    3⤵
    PID:964
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "145^177"
    3⤵
    PID:4164
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "195^177"
    3⤵
    PID:1052
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "128^177"
    3⤵
    PID:2892
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "157^177"
    3⤵
    PID:3848
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "145^177"
    3⤵
    PID:4256
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "216^177"
    3⤵
    PID:3488
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "145^177"
    3⤵
    PID:3764
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "135^177"
    3⤵
    PID:1828
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "132^177"
    3⤵
    PID:4272
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "137^177"
    3⤵
    PID:2836
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "134^177"
    3⤵
    PID:1756
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "132^177"
    3⤵
    PID:1508
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "136^177"
    3⤵
    PID:2856
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "135^177"
    3⤵
    PID:4952
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "137^177"
    3⤵
    PID:2948
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "157^177"
    3⤵
    PID:3996
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "155^177"
    3⤵
    PID:5012
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "216^177"
    3⤵
    PID:3824
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "145^177"
    3⤵
    PID:4280
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "129^177"
    3⤵
    PID:920
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "157^177"
    3⤵
    PID:448
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "145^177"
    3⤵
    PID:3740
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "216^177"
    3⤵
    PID:4256
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "145^177"
    3⤵
    PID:400
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "129^177"
    3⤵
    PID:2864
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "152^177"
    3⤵
    PID:3944
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "216^177"
    3⤵
    PID:636
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "159^177"
    3⤵
    PID:4640
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "195^177"
    3⤵
    PID:1572
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "130^177"
    3⤵
    PID:1416
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "141^177"
    3⤵
    PID:3392
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "196^177"
    3⤵
    PID:3024
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "194^177"
    3⤵
    PID:2428
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "212^177"
    3⤵
    PID:4032
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "195^177"
    3⤵
    PID:4604
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "130^177"
    3⤵
    PID:3984
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "131^177"
    3⤵
    PID:4220
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "139^177"
    3⤵
    PID:4788
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "139^177"
    3⤵
    PID:2892
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "242^177"
    3⤵
    PID:752
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "208^177"
    3⤵
    PID:4568
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "221^177"
    3⤵
    PID:1564
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "221^177"
    3⤵
    PID:5028
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "230^177"
    3⤵
    PID:1368
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "216^177"
    3⤵
    PID:3032
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "223^177"
    3⤵
    PID:4056
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "213^177"
    3⤵
    PID:1572
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "222^177"
    3⤵
    PID:4872
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "198^177"
    3⤵
    PID:3540
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "225^177"
    3⤵
    PID:3392
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "195^177"
    3⤵
    PID:2860
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "222^177"
    3⤵
    PID:2428
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "210^177"
    3⤵
    PID:2312
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "240^177"
    3⤵
    PID:1928
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "153^177"
    3⤵
    PID:2104
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "216^177"
    3⤵
    PID:1396
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "145^177"
    3⤵
    PID:3028
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "195^177"
    3⤵
    PID:2892
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "128^177"
    3⤵
    PID:752
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "145^177"
    3⤵
    PID:4128
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "157^177"
    3⤵
    PID:4968
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "216^177"
    3⤵
    PID:548
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "145^177"
    3⤵
    PID:4100
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "129^177"
    3⤵
    PID:1892
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "157^177"
    3⤵
    PID:1528
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "216^177"
    3⤵
    PID:4716
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "145^177"
    3⤵
    PID:1452
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "129^177"
    3⤵
    PID:1212
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "157^177"
    3⤵
    PID:2856
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "145^177"
    3⤵
    PID:1708
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "216^177"
    3⤵
    PID:4392
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "145^177"
    3⤵
    PID:4032
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "129^177"
    3⤵
    PID:1644
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "157^177"
    3⤵
    PID:3984
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "145^177"
    3⤵
    PID:232
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "216^177"
    3⤵
    PID:4924
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "145^177"
    3⤵
    PID:3528
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "129^177"
    3⤵
    PID:496
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "152^177"
    3⤵
    PID:4092
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c set /a "141^177"
    3⤵
    PID:3780
- - C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe
    "C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe"
    3⤵
    - Checks QEMU agent file
    - Suspicious use of NtCreateThreadExHideFromDebugger
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:3004
- C:\Windows\SysWOW64\wscript.exe
  "C:\Windows\SysWOW64\wscript.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  PID:4716
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe"
    3⤵
    PID:3540

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsk861A.tmp\System.dll

Filesize
11KB

MD5
c9473cb90d79a374b2ba6040ca16e45c

SHA1
ab95b54f12796dce57210d65f05124a6ed81234a

SHA256
b80a5cba69d1853ed5979b0ca0352437bf368a5cfb86cb4528edadd410e11352

SHA512
eafe7d5894622bc21f663bca4dd594392ee0f5b29270b6b56b0187093d6a3a103545464ff6398ad32d2cf15dab79b1f133218ba9ba337ddc01330b5ada804d7b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk861A.tmp\System.dll

Filesize
11KB

MD5
c9473cb90d79a374b2ba6040ca16e45c

SHA1
ab95b54f12796dce57210d65f05124a6ed81234a

SHA256
b80a5cba69d1853ed5979b0ca0352437bf368a5cfb86cb4528edadd410e11352

SHA512
eafe7d5894622bc21f663bca4dd594392ee0f5b29270b6b56b0187093d6a3a103545464ff6398ad32d2cf15dab79b1f133218ba9ba337ddc01330b5ada804d7b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk861A.tmp\System.dll

Filesize
11KB

MD5
c9473cb90d79a374b2ba6040ca16e45c

SHA1
ab95b54f12796dce57210d65f05124a6ed81234a

SHA256
b80a5cba69d1853ed5979b0ca0352437bf368a5cfb86cb4528edadd410e11352

SHA512
eafe7d5894622bc21f663bca4dd594392ee0f5b29270b6b56b0187093d6a3a103545464ff6398ad32d2cf15dab79b1f133218ba9ba337ddc01330b5ada804d7b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk861A.tmp\nsExec.dll

Filesize
6KB

MD5
0a6f707fa22c3f3e5d1abb54b0894ad6

SHA1
610cb2c3623199d0d7461fc775297e23cef88c4e

SHA256
370e47364561fa501b1300b056fb53fae12b1639fdf5f113275bee03546081c0

SHA512
af0c8ca0c892f1b757fbd700061f3d81417dff11d89bdff45e977de81ad51c97862406cf7e230e76cf99497f93f57bf09609740953cd81b0d795465ac2623ea8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk861A.tmp\nsExec.dll

Filesize
6KB

MD5
0a6f707fa22c3f3e5d1abb54b0894ad6

SHA1
610cb2c3623199d0d7461fc775297e23cef88c4e

SHA256
370e47364561fa501b1300b056fb53fae12b1639fdf5f113275bee03546081c0

SHA512
af0c8ca0c892f1b757fbd700061f3d81417dff11d89bdff45e977de81ad51c97862406cf7e230e76cf99497f93f57bf09609740953cd81b0d795465ac2623ea8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk861A.tmp\nsExec.dll

Filesize
6KB

MD5
0a6f707fa22c3f3e5d1abb54b0894ad6

SHA1
610cb2c3623199d0d7461fc775297e23cef88c4e

SHA256
370e47364561fa501b1300b056fb53fae12b1639fdf5f113275bee03546081c0

SHA512
af0c8ca0c892f1b757fbd700061f3d81417dff11d89bdff45e977de81ad51c97862406cf7e230e76cf99497f93f57bf09609740953cd81b0d795465ac2623ea8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk861A.tmp\nsExec.dll

Filesize
6KB

MD5
0a6f707fa22c3f3e5d1abb54b0894ad6

SHA1
610cb2c3623199d0d7461fc775297e23cef88c4e

SHA256
370e47364561fa501b1300b056fb53fae12b1639fdf5f113275bee03546081c0

SHA512
af0c8ca0c892f1b757fbd700061f3d81417dff11d89bdff45e977de81ad51c97862406cf7e230e76cf99497f93f57bf09609740953cd81b0d795465ac2623ea8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk861A.tmp\nsExec.dll

Filesize
6KB

MD5
0a6f707fa22c3f3e5d1abb54b0894ad6

SHA1
610cb2c3623199d0d7461fc775297e23cef88c4e

SHA256
370e47364561fa501b1300b056fb53fae12b1639fdf5f113275bee03546081c0

SHA512
af0c8ca0c892f1b757fbd700061f3d81417dff11d89bdff45e977de81ad51c97862406cf7e230e76cf99497f93f57bf09609740953cd81b0d795465ac2623ea8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk861A.tmp\nsExec.dll

Filesize
6KB

MD5
0a6f707fa22c3f3e5d1abb54b0894ad6

SHA1
610cb2c3623199d0d7461fc775297e23cef88c4e

SHA256
370e47364561fa501b1300b056fb53fae12b1639fdf5f113275bee03546081c0

SHA512
af0c8ca0c892f1b757fbd700061f3d81417dff11d89bdff45e977de81ad51c97862406cf7e230e76cf99497f93f57bf09609740953cd81b0d795465ac2623ea8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk861A.tmp\nsExec.dll

Filesize
6KB

MD5
0a6f707fa22c3f3e5d1abb54b0894ad6

SHA1
610cb2c3623199d0d7461fc775297e23cef88c4e

SHA256
370e47364561fa501b1300b056fb53fae12b1639fdf5f113275bee03546081c0

SHA512
af0c8ca0c892f1b757fbd700061f3d81417dff11d89bdff45e977de81ad51c97862406cf7e230e76cf99497f93f57bf09609740953cd81b0d795465ac2623ea8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk861A.tmp\nsExec.dll

Filesize
6KB

MD5
0a6f707fa22c3f3e5d1abb54b0894ad6

SHA1
610cb2c3623199d0d7461fc775297e23cef88c4e

SHA256
370e47364561fa501b1300b056fb53fae12b1639fdf5f113275bee03546081c0

SHA512
af0c8ca0c892f1b757fbd700061f3d81417dff11d89bdff45e977de81ad51c97862406cf7e230e76cf99497f93f57bf09609740953cd81b0d795465ac2623ea8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk861A.tmp\nsExec.dll

Filesize
6KB

MD5
0a6f707fa22c3f3e5d1abb54b0894ad6

SHA1
610cb2c3623199d0d7461fc775297e23cef88c4e

SHA256
370e47364561fa501b1300b056fb53fae12b1639fdf5f113275bee03546081c0

SHA512
af0c8ca0c892f1b757fbd700061f3d81417dff11d89bdff45e977de81ad51c97862406cf7e230e76cf99497f93f57bf09609740953cd81b0d795465ac2623ea8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk861A.tmp\nsExec.dll

Filesize
6KB

MD5
0a6f707fa22c3f3e5d1abb54b0894ad6

SHA1
610cb2c3623199d0d7461fc775297e23cef88c4e

SHA256
370e47364561fa501b1300b056fb53fae12b1639fdf5f113275bee03546081c0

SHA512
af0c8ca0c892f1b757fbd700061f3d81417dff11d89bdff45e977de81ad51c97862406cf7e230e76cf99497f93f57bf09609740953cd81b0d795465ac2623ea8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk861A.tmp\nsExec.dll

Filesize
6KB

MD5
0a6f707fa22c3f3e5d1abb54b0894ad6

SHA1
610cb2c3623199d0d7461fc775297e23cef88c4e

SHA256
370e47364561fa501b1300b056fb53fae12b1639fdf5f113275bee03546081c0

SHA512
af0c8ca0c892f1b757fbd700061f3d81417dff11d89bdff45e977de81ad51c97862406cf7e230e76cf99497f93f57bf09609740953cd81b0d795465ac2623ea8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk861A.tmp\nsExec.dll

Filesize
6KB

MD5
0a6f707fa22c3f3e5d1abb54b0894ad6

SHA1
610cb2c3623199d0d7461fc775297e23cef88c4e

SHA256
370e47364561fa501b1300b056fb53fae12b1639fdf5f113275bee03546081c0

SHA512
af0c8ca0c892f1b757fbd700061f3d81417dff11d89bdff45e977de81ad51c97862406cf7e230e76cf99497f93f57bf09609740953cd81b0d795465ac2623ea8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk861A.tmp\nsExec.dll

Filesize
6KB

MD5
0a6f707fa22c3f3e5d1abb54b0894ad6

SHA1
610cb2c3623199d0d7461fc775297e23cef88c4e

SHA256
370e47364561fa501b1300b056fb53fae12b1639fdf5f113275bee03546081c0

SHA512
af0c8ca0c892f1b757fbd700061f3d81417dff11d89bdff45e977de81ad51c97862406cf7e230e76cf99497f93f57bf09609740953cd81b0d795465ac2623ea8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk861A.tmp\nsExec.dll

Filesize
6KB

MD5
0a6f707fa22c3f3e5d1abb54b0894ad6

SHA1
610cb2c3623199d0d7461fc775297e23cef88c4e

SHA256
370e47364561fa501b1300b056fb53fae12b1639fdf5f113275bee03546081c0

SHA512
af0c8ca0c892f1b757fbd700061f3d81417dff11d89bdff45e977de81ad51c97862406cf7e230e76cf99497f93f57bf09609740953cd81b0d795465ac2623ea8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk861A.tmp\nsExec.dll

Filesize
6KB

MD5
0a6f707fa22c3f3e5d1abb54b0894ad6

SHA1
610cb2c3623199d0d7461fc775297e23cef88c4e

SHA256
370e47364561fa501b1300b056fb53fae12b1639fdf5f113275bee03546081c0

SHA512
af0c8ca0c892f1b757fbd700061f3d81417dff11d89bdff45e977de81ad51c97862406cf7e230e76cf99497f93f57bf09609740953cd81b0d795465ac2623ea8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk861A.tmp\nsExec.dll

Filesize
6KB

MD5
0a6f707fa22c3f3e5d1abb54b0894ad6

SHA1
610cb2c3623199d0d7461fc775297e23cef88c4e

SHA256
370e47364561fa501b1300b056fb53fae12b1639fdf5f113275bee03546081c0

SHA512
af0c8ca0c892f1b757fbd700061f3d81417dff11d89bdff45e977de81ad51c97862406cf7e230e76cf99497f93f57bf09609740953cd81b0d795465ac2623ea8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk861A.tmp\nsExec.dll

Filesize
6KB

MD5
0a6f707fa22c3f3e5d1abb54b0894ad6

SHA1
610cb2c3623199d0d7461fc775297e23cef88c4e

SHA256
370e47364561fa501b1300b056fb53fae12b1639fdf5f113275bee03546081c0

SHA512
af0c8ca0c892f1b757fbd700061f3d81417dff11d89bdff45e977de81ad51c97862406cf7e230e76cf99497f93f57bf09609740953cd81b0d795465ac2623ea8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk861A.tmp\nsExec.dll

Filesize
6KB

MD5
0a6f707fa22c3f3e5d1abb54b0894ad6

SHA1
610cb2c3623199d0d7461fc775297e23cef88c4e

SHA256
370e47364561fa501b1300b056fb53fae12b1639fdf5f113275bee03546081c0

SHA512
af0c8ca0c892f1b757fbd700061f3d81417dff11d89bdff45e977de81ad51c97862406cf7e230e76cf99497f93f57bf09609740953cd81b0d795465ac2623ea8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk861A.tmp\nsExec.dll

Filesize
6KB

MD5
0a6f707fa22c3f3e5d1abb54b0894ad6

SHA1
610cb2c3623199d0d7461fc775297e23cef88c4e

SHA256
370e47364561fa501b1300b056fb53fae12b1639fdf5f113275bee03546081c0

SHA512
af0c8ca0c892f1b757fbd700061f3d81417dff11d89bdff45e977de81ad51c97862406cf7e230e76cf99497f93f57bf09609740953cd81b0d795465ac2623ea8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk861A.tmp\nsExec.dll

Filesize
6KB

MD5
0a6f707fa22c3f3e5d1abb54b0894ad6

SHA1
610cb2c3623199d0d7461fc775297e23cef88c4e

SHA256
370e47364561fa501b1300b056fb53fae12b1639fdf5f113275bee03546081c0

SHA512
af0c8ca0c892f1b757fbd700061f3d81417dff11d89bdff45e977de81ad51c97862406cf7e230e76cf99497f93f57bf09609740953cd81b0d795465ac2623ea8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk861A.tmp\nsExec.dll

Filesize
6KB

MD5
0a6f707fa22c3f3e5d1abb54b0894ad6

SHA1
610cb2c3623199d0d7461fc775297e23cef88c4e

SHA256
370e47364561fa501b1300b056fb53fae12b1639fdf5f113275bee03546081c0

SHA512
af0c8ca0c892f1b757fbd700061f3d81417dff11d89bdff45e977de81ad51c97862406cf7e230e76cf99497f93f57bf09609740953cd81b0d795465ac2623ea8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk861A.tmp\nsExec.dll

Filesize
6KB

MD5
0a6f707fa22c3f3e5d1abb54b0894ad6

SHA1
610cb2c3623199d0d7461fc775297e23cef88c4e

SHA256
370e47364561fa501b1300b056fb53fae12b1639fdf5f113275bee03546081c0

SHA512
af0c8ca0c892f1b757fbd700061f3d81417dff11d89bdff45e977de81ad51c97862406cf7e230e76cf99497f93f57bf09609740953cd81b0d795465ac2623ea8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk861A.tmp\nsExec.dll

Filesize
6KB

MD5
0a6f707fa22c3f3e5d1abb54b0894ad6

SHA1
610cb2c3623199d0d7461fc775297e23cef88c4e

SHA256
370e47364561fa501b1300b056fb53fae12b1639fdf5f113275bee03546081c0

SHA512
af0c8ca0c892f1b757fbd700061f3d81417dff11d89bdff45e977de81ad51c97862406cf7e230e76cf99497f93f57bf09609740953cd81b0d795465ac2623ea8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk861A.tmp\nsExec.dll

Filesize
6KB

MD5
0a6f707fa22c3f3e5d1abb54b0894ad6

SHA1
610cb2c3623199d0d7461fc775297e23cef88c4e

SHA256
370e47364561fa501b1300b056fb53fae12b1639fdf5f113275bee03546081c0

SHA512
af0c8ca0c892f1b757fbd700061f3d81417dff11d89bdff45e977de81ad51c97862406cf7e230e76cf99497f93f57bf09609740953cd81b0d795465ac2623ea8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk861A.tmp\nsExec.dll

Filesize
6KB

MD5
0a6f707fa22c3f3e5d1abb54b0894ad6

SHA1
610cb2c3623199d0d7461fc775297e23cef88c4e

SHA256
370e47364561fa501b1300b056fb53fae12b1639fdf5f113275bee03546081c0

SHA512
af0c8ca0c892f1b757fbd700061f3d81417dff11d89bdff45e977de81ad51c97862406cf7e230e76cf99497f93f57bf09609740953cd81b0d795465ac2623ea8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk861A.tmp\nsExec.dll

Filesize
6KB

MD5
0a6f707fa22c3f3e5d1abb54b0894ad6

SHA1
610cb2c3623199d0d7461fc775297e23cef88c4e

SHA256
370e47364561fa501b1300b056fb53fae12b1639fdf5f113275bee03546081c0

SHA512
af0c8ca0c892f1b757fbd700061f3d81417dff11d89bdff45e977de81ad51c97862406cf7e230e76cf99497f93f57bf09609740953cd81b0d795465ac2623ea8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk861A.tmp\nsExec.dll

Filesize
6KB

MD5
0a6f707fa22c3f3e5d1abb54b0894ad6

SHA1
610cb2c3623199d0d7461fc775297e23cef88c4e

SHA256
370e47364561fa501b1300b056fb53fae12b1639fdf5f113275bee03546081c0

SHA512
af0c8ca0c892f1b757fbd700061f3d81417dff11d89bdff45e977de81ad51c97862406cf7e230e76cf99497f93f57bf09609740953cd81b0d795465ac2623ea8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk861A.tmp\nsExec.dll

Filesize
6KB

MD5
0a6f707fa22c3f3e5d1abb54b0894ad6

SHA1
610cb2c3623199d0d7461fc775297e23cef88c4e

SHA256
370e47364561fa501b1300b056fb53fae12b1639fdf5f113275bee03546081c0

SHA512
af0c8ca0c892f1b757fbd700061f3d81417dff11d89bdff45e977de81ad51c97862406cf7e230e76cf99497f93f57bf09609740953cd81b0d795465ac2623ea8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk861A.tmp\nsExec.dll

Filesize
6KB

MD5
0a6f707fa22c3f3e5d1abb54b0894ad6

SHA1
610cb2c3623199d0d7461fc775297e23cef88c4e

SHA256
370e47364561fa501b1300b056fb53fae12b1639fdf5f113275bee03546081c0

SHA512
af0c8ca0c892f1b757fbd700061f3d81417dff11d89bdff45e977de81ad51c97862406cf7e230e76cf99497f93f57bf09609740953cd81b0d795465ac2623ea8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk861A.tmp\nsExec.dll

Filesize
6KB

MD5
0a6f707fa22c3f3e5d1abb54b0894ad6

SHA1
610cb2c3623199d0d7461fc775297e23cef88c4e

SHA256
370e47364561fa501b1300b056fb53fae12b1639fdf5f113275bee03546081c0

SHA512
af0c8ca0c892f1b757fbd700061f3d81417dff11d89bdff45e977de81ad51c97862406cf7e230e76cf99497f93f57bf09609740953cd81b0d795465ac2623ea8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk861A.tmp\nsExec.dll

Filesize
6KB

MD5
0a6f707fa22c3f3e5d1abb54b0894ad6

SHA1
610cb2c3623199d0d7461fc775297e23cef88c4e

SHA256
370e47364561fa501b1300b056fb53fae12b1639fdf5f113275bee03546081c0

SHA512
af0c8ca0c892f1b757fbd700061f3d81417dff11d89bdff45e977de81ad51c97862406cf7e230e76cf99497f93f57bf09609740953cd81b0d795465ac2623ea8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk861A.tmp\nsExec.dll

Filesize
6KB

MD5
0a6f707fa22c3f3e5d1abb54b0894ad6

SHA1
610cb2c3623199d0d7461fc775297e23cef88c4e

SHA256
370e47364561fa501b1300b056fb53fae12b1639fdf5f113275bee03546081c0

SHA512
af0c8ca0c892f1b757fbd700061f3d81417dff11d89bdff45e977de81ad51c97862406cf7e230e76cf99497f93f57bf09609740953cd81b0d795465ac2623ea8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk861A.tmp\nsExec.dll

Filesize
6KB

MD5
0a6f707fa22c3f3e5d1abb54b0894ad6

SHA1
610cb2c3623199d0d7461fc775297e23cef88c4e

SHA256
370e47364561fa501b1300b056fb53fae12b1639fdf5f113275bee03546081c0

SHA512
af0c8ca0c892f1b757fbd700061f3d81417dff11d89bdff45e977de81ad51c97862406cf7e230e76cf99497f93f57bf09609740953cd81b0d795465ac2623ea8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk861A.tmp\nsExec.dll

Filesize
6KB

MD5
0a6f707fa22c3f3e5d1abb54b0894ad6

SHA1
610cb2c3623199d0d7461fc775297e23cef88c4e

SHA256
370e47364561fa501b1300b056fb53fae12b1639fdf5f113275bee03546081c0

SHA512
af0c8ca0c892f1b757fbd700061f3d81417dff11d89bdff45e977de81ad51c97862406cf7e230e76cf99497f93f57bf09609740953cd81b0d795465ac2623ea8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk861A.tmp\nsExec.dll

Filesize
6KB

MD5
0a6f707fa22c3f3e5d1abb54b0894ad6

SHA1
610cb2c3623199d0d7461fc775297e23cef88c4e

SHA256
370e47364561fa501b1300b056fb53fae12b1639fdf5f113275bee03546081c0

SHA512
af0c8ca0c892f1b757fbd700061f3d81417dff11d89bdff45e977de81ad51c97862406cf7e230e76cf99497f93f57bf09609740953cd81b0d795465ac2623ea8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk861A.tmp\nsExec.dll

Filesize
6KB

MD5
0a6f707fa22c3f3e5d1abb54b0894ad6

SHA1
610cb2c3623199d0d7461fc775297e23cef88c4e

SHA256
370e47364561fa501b1300b056fb53fae12b1639fdf5f113275bee03546081c0

SHA512
af0c8ca0c892f1b757fbd700061f3d81417dff11d89bdff45e977de81ad51c97862406cf7e230e76cf99497f93f57bf09609740953cd81b0d795465ac2623ea8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk861A.tmp\nsExec.dll

Filesize
6KB

MD5
0a6f707fa22c3f3e5d1abb54b0894ad6

SHA1
610cb2c3623199d0d7461fc775297e23cef88c4e

SHA256
370e47364561fa501b1300b056fb53fae12b1639fdf5f113275bee03546081c0

SHA512
af0c8ca0c892f1b757fbd700061f3d81417dff11d89bdff45e977de81ad51c97862406cf7e230e76cf99497f93f57bf09609740953cd81b0d795465ac2623ea8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk861A.tmp\nsExec.dll

Filesize
6KB

MD5
0a6f707fa22c3f3e5d1abb54b0894ad6

SHA1
610cb2c3623199d0d7461fc775297e23cef88c4e

SHA256
370e47364561fa501b1300b056fb53fae12b1639fdf5f113275bee03546081c0

SHA512
af0c8ca0c892f1b757fbd700061f3d81417dff11d89bdff45e977de81ad51c97862406cf7e230e76cf99497f93f57bf09609740953cd81b0d795465ac2623ea8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk861A.tmp\nsExec.dll

Filesize
6KB

MD5
0a6f707fa22c3f3e5d1abb54b0894ad6

SHA1
610cb2c3623199d0d7461fc775297e23cef88c4e

SHA256
370e47364561fa501b1300b056fb53fae12b1639fdf5f113275bee03546081c0

SHA512
af0c8ca0c892f1b757fbd700061f3d81417dff11d89bdff45e977de81ad51c97862406cf7e230e76cf99497f93f57bf09609740953cd81b0d795465ac2623ea8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk861A.tmp\nsExec.dll

Filesize
6KB

MD5
0a6f707fa22c3f3e5d1abb54b0894ad6

SHA1
610cb2c3623199d0d7461fc775297e23cef88c4e

SHA256
370e47364561fa501b1300b056fb53fae12b1639fdf5f113275bee03546081c0

SHA512
af0c8ca0c892f1b757fbd700061f3d81417dff11d89bdff45e977de81ad51c97862406cf7e230e76cf99497f93f57bf09609740953cd81b0d795465ac2623ea8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk861A.tmp\nsExec.dll

Filesize
6KB

MD5
0a6f707fa22c3f3e5d1abb54b0894ad6

SHA1
610cb2c3623199d0d7461fc775297e23cef88c4e

SHA256
370e47364561fa501b1300b056fb53fae12b1639fdf5f113275bee03546081c0

SHA512
af0c8ca0c892f1b757fbd700061f3d81417dff11d89bdff45e977de81ad51c97862406cf7e230e76cf99497f93f57bf09609740953cd81b0d795465ac2623ea8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk861A.tmp\nsExec.dll

Filesize
6KB

MD5
0a6f707fa22c3f3e5d1abb54b0894ad6

SHA1
610cb2c3623199d0d7461fc775297e23cef88c4e

SHA256
370e47364561fa501b1300b056fb53fae12b1639fdf5f113275bee03546081c0

SHA512
af0c8ca0c892f1b757fbd700061f3d81417dff11d89bdff45e977de81ad51c97862406cf7e230e76cf99497f93f57bf09609740953cd81b0d795465ac2623ea8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk861A.tmp\nsExec.dll

Filesize
6KB

MD5
0a6f707fa22c3f3e5d1abb54b0894ad6

SHA1
610cb2c3623199d0d7461fc775297e23cef88c4e

SHA256
370e47364561fa501b1300b056fb53fae12b1639fdf5f113275bee03546081c0

SHA512
af0c8ca0c892f1b757fbd700061f3d81417dff11d89bdff45e977de81ad51c97862406cf7e230e76cf99497f93f57bf09609740953cd81b0d795465ac2623ea8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk861A.tmp\nsExec.dll

Filesize
6KB

MD5
0a6f707fa22c3f3e5d1abb54b0894ad6

SHA1
610cb2c3623199d0d7461fc775297e23cef88c4e

SHA256
370e47364561fa501b1300b056fb53fae12b1639fdf5f113275bee03546081c0

SHA512
af0c8ca0c892f1b757fbd700061f3d81417dff11d89bdff45e977de81ad51c97862406cf7e230e76cf99497f93f57bf09609740953cd81b0d795465ac2623ea8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk861A.tmp\nsExec.dll

Filesize
6KB

MD5
0a6f707fa22c3f3e5d1abb54b0894ad6

SHA1
610cb2c3623199d0d7461fc775297e23cef88c4e

SHA256
370e47364561fa501b1300b056fb53fae12b1639fdf5f113275bee03546081c0

SHA512
af0c8ca0c892f1b757fbd700061f3d81417dff11d89bdff45e977de81ad51c97862406cf7e230e76cf99497f93f57bf09609740953cd81b0d795465ac2623ea8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk861A.tmp\nsExec.dll

Filesize
6KB

MD5
0a6f707fa22c3f3e5d1abb54b0894ad6

SHA1
610cb2c3623199d0d7461fc775297e23cef88c4e

SHA256
370e47364561fa501b1300b056fb53fae12b1639fdf5f113275bee03546081c0

SHA512
af0c8ca0c892f1b757fbd700061f3d81417dff11d89bdff45e977de81ad51c97862406cf7e230e76cf99497f93f57bf09609740953cd81b0d795465ac2623ea8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk861A.tmp\nsExec.dll

Filesize
6KB

MD5
0a6f707fa22c3f3e5d1abb54b0894ad6

SHA1
610cb2c3623199d0d7461fc775297e23cef88c4e

SHA256
370e47364561fa501b1300b056fb53fae12b1639fdf5f113275bee03546081c0

SHA512
af0c8ca0c892f1b757fbd700061f3d81417dff11d89bdff45e977de81ad51c97862406cf7e230e76cf99497f93f57bf09609740953cd81b0d795465ac2623ea8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk861A.tmp\nsExec.dll

Filesize
6KB

MD5
0a6f707fa22c3f3e5d1abb54b0894ad6

SHA1
610cb2c3623199d0d7461fc775297e23cef88c4e

SHA256
370e47364561fa501b1300b056fb53fae12b1639fdf5f113275bee03546081c0

SHA512
af0c8ca0c892f1b757fbd700061f3d81417dff11d89bdff45e977de81ad51c97862406cf7e230e76cf99497f93f57bf09609740953cd81b0d795465ac2623ea8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk861A.tmp\nsExec.dll

Filesize
6KB

MD5
0a6f707fa22c3f3e5d1abb54b0894ad6

SHA1
610cb2c3623199d0d7461fc775297e23cef88c4e

SHA256
370e47364561fa501b1300b056fb53fae12b1639fdf5f113275bee03546081c0

SHA512
af0c8ca0c892f1b757fbd700061f3d81417dff11d89bdff45e977de81ad51c97862406cf7e230e76cf99497f93f57bf09609740953cd81b0d795465ac2623ea8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk861A.tmp\nsExec.dll

Filesize
6KB

MD5
0a6f707fa22c3f3e5d1abb54b0894ad6

SHA1
610cb2c3623199d0d7461fc775297e23cef88c4e

SHA256
370e47364561fa501b1300b056fb53fae12b1639fdf5f113275bee03546081c0

SHA512
af0c8ca0c892f1b757fbd700061f3d81417dff11d89bdff45e977de81ad51c97862406cf7e230e76cf99497f93f57bf09609740953cd81b0d795465ac2623ea8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk861A.tmp\nsExec.dll

Filesize
6KB

MD5
0a6f707fa22c3f3e5d1abb54b0894ad6

SHA1
610cb2c3623199d0d7461fc775297e23cef88c4e

SHA256
370e47364561fa501b1300b056fb53fae12b1639fdf5f113275bee03546081c0

SHA512
af0c8ca0c892f1b757fbd700061f3d81417dff11d89bdff45e977de81ad51c97862406cf7e230e76cf99497f93f57bf09609740953cd81b0d795465ac2623ea8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk861A.tmp\nsExec.dll

Filesize
6KB

MD5
0a6f707fa22c3f3e5d1abb54b0894ad6

SHA1
610cb2c3623199d0d7461fc775297e23cef88c4e

SHA256
370e47364561fa501b1300b056fb53fae12b1639fdf5f113275bee03546081c0

SHA512
af0c8ca0c892f1b757fbd700061f3d81417dff11d89bdff45e977de81ad51c97862406cf7e230e76cf99497f93f57bf09609740953cd81b0d795465ac2623ea8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk861A.tmp\nsExec.dll

Filesize
6KB

MD5
0a6f707fa22c3f3e5d1abb54b0894ad6

SHA1
610cb2c3623199d0d7461fc775297e23cef88c4e

SHA256
370e47364561fa501b1300b056fb53fae12b1639fdf5f113275bee03546081c0

SHA512
af0c8ca0c892f1b757fbd700061f3d81417dff11d89bdff45e977de81ad51c97862406cf7e230e76cf99497f93f57bf09609740953cd81b0d795465ac2623ea8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk861A.tmp\nsExec.dll

Filesize
6KB

MD5
0a6f707fa22c3f3e5d1abb54b0894ad6

SHA1
610cb2c3623199d0d7461fc775297e23cef88c4e

SHA256
370e47364561fa501b1300b056fb53fae12b1639fdf5f113275bee03546081c0

SHA512
af0c8ca0c892f1b757fbd700061f3d81417dff11d89bdff45e977de81ad51c97862406cf7e230e76cf99497f93f57bf09609740953cd81b0d795465ac2623ea8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk861A.tmp\nsExec.dll

Filesize
6KB

MD5
0a6f707fa22c3f3e5d1abb54b0894ad6

SHA1
610cb2c3623199d0d7461fc775297e23cef88c4e

SHA256
370e47364561fa501b1300b056fb53fae12b1639fdf5f113275bee03546081c0

SHA512
af0c8ca0c892f1b757fbd700061f3d81417dff11d89bdff45e977de81ad51c97862406cf7e230e76cf99497f93f57bf09609740953cd81b0d795465ac2623ea8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk861A.tmp\nsExec.dll

Filesize
6KB

MD5
0a6f707fa22c3f3e5d1abb54b0894ad6

SHA1
610cb2c3623199d0d7461fc775297e23cef88c4e

SHA256
370e47364561fa501b1300b056fb53fae12b1639fdf5f113275bee03546081c0

SHA512
af0c8ca0c892f1b757fbd700061f3d81417dff11d89bdff45e977de81ad51c97862406cf7e230e76cf99497f93f57bf09609740953cd81b0d795465ac2623ea8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk861A.tmp\nsExec.dll

Filesize
6KB

MD5
0a6f707fa22c3f3e5d1abb54b0894ad6

SHA1
610cb2c3623199d0d7461fc775297e23cef88c4e

SHA256
370e47364561fa501b1300b056fb53fae12b1639fdf5f113275bee03546081c0

SHA512
af0c8ca0c892f1b757fbd700061f3d81417dff11d89bdff45e977de81ad51c97862406cf7e230e76cf99497f93f57bf09609740953cd81b0d795465ac2623ea8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk861A.tmp\nsExec.dll

Filesize
6KB

MD5
0a6f707fa22c3f3e5d1abb54b0894ad6

SHA1
610cb2c3623199d0d7461fc775297e23cef88c4e

SHA256
370e47364561fa501b1300b056fb53fae12b1639fdf5f113275bee03546081c0

SHA512
af0c8ca0c892f1b757fbd700061f3d81417dff11d89bdff45e977de81ad51c97862406cf7e230e76cf99497f93f57bf09609740953cd81b0d795465ac2623ea8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk861A.tmp\nsExec.dll

Filesize
6KB

MD5
0a6f707fa22c3f3e5d1abb54b0894ad6

SHA1
610cb2c3623199d0d7461fc775297e23cef88c4e

SHA256
370e47364561fa501b1300b056fb53fae12b1639fdf5f113275bee03546081c0

SHA512
af0c8ca0c892f1b757fbd700061f3d81417dff11d89bdff45e977de81ad51c97862406cf7e230e76cf99497f93f57bf09609740953cd81b0d795465ac2623ea8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk861A.tmp\nsExec.dll

Filesize
6KB

MD5
0a6f707fa22c3f3e5d1abb54b0894ad6

SHA1
610cb2c3623199d0d7461fc775297e23cef88c4e

SHA256
370e47364561fa501b1300b056fb53fae12b1639fdf5f113275bee03546081c0

SHA512
af0c8ca0c892f1b757fbd700061f3d81417dff11d89bdff45e977de81ad51c97862406cf7e230e76cf99497f93f57bf09609740953cd81b0d795465ac2623ea8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk861A.tmp\nsExec.dll

Filesize
6KB

MD5
0a6f707fa22c3f3e5d1abb54b0894ad6

SHA1
610cb2c3623199d0d7461fc775297e23cef88c4e

SHA256
370e47364561fa501b1300b056fb53fae12b1639fdf5f113275bee03546081c0

SHA512
af0c8ca0c892f1b757fbd700061f3d81417dff11d89bdff45e977de81ad51c97862406cf7e230e76cf99497f93f57bf09609740953cd81b0d795465ac2623ea8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk861A.tmp\nsExec.dll

Filesize
6KB

MD5
0a6f707fa22c3f3e5d1abb54b0894ad6

SHA1
610cb2c3623199d0d7461fc775297e23cef88c4e

SHA256
370e47364561fa501b1300b056fb53fae12b1639fdf5f113275bee03546081c0

SHA512
af0c8ca0c892f1b757fbd700061f3d81417dff11d89bdff45e977de81ad51c97862406cf7e230e76cf99497f93f57bf09609740953cd81b0d795465ac2623ea8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk861A.tmp\nsExec.dll

Filesize
6KB

MD5
0a6f707fa22c3f3e5d1abb54b0894ad6

SHA1
610cb2c3623199d0d7461fc775297e23cef88c4e

SHA256
370e47364561fa501b1300b056fb53fae12b1639fdf5f113275bee03546081c0

SHA512
af0c8ca0c892f1b757fbd700061f3d81417dff11d89bdff45e977de81ad51c97862406cf7e230e76cf99497f93f57bf09609740953cd81b0d795465ac2623ea8

Download Submit
memory/680-1145-0x0000000003490000-0x00000000034A0000-memory.dmp

Filesize
64KB

Download
memory/680-1146-0x0000000003490000-0x00000000034A0000-memory.dmp

Filesize
64KB

Download
memory/680-1156-0x0000000003490000-0x00000000034A0000-memory.dmp

Filesize
64KB

Download
memory/680-1163-0x0000000003490000-0x00000000034A0000-memory.dmp

Filesize
64KB

Download
memory/680-1157-0x0000000003490000-0x00000000034A0000-memory.dmp

Filesize
64KB

Download
memory/680-1162-0x0000000003490000-0x00000000034A0000-memory.dmp

Filesize
64KB

Download
memory/680-1160-0x0000000003490000-0x00000000034A0000-memory.dmp

Filesize
64KB

Download
memory/680-1159-0x0000000003490000-0x00000000034A0000-memory.dmp

Filesize
64KB

Download
memory/680-1158-0x0000000003490000-0x00000000034A0000-memory.dmp

Filesize
64KB

Download
memory/680-1155-0x00000000013D0000-0x00000000013E0000-memory.dmp

Filesize
64KB

Download
memory/680-1154-0x0000000003490000-0x00000000034A0000-memory.dmp

Filesize
64KB

Download
memory/680-1113-0x0000000008FF0000-0x0000000009178000-memory.dmp

Filesize
1.5MB

Download
memory/680-1153-0x0000000003490000-0x00000000034A0000-memory.dmp

Filesize
64KB

Download
memory/680-1151-0x0000000003490000-0x00000000034A0000-memory.dmp

Filesize
64KB

Download
memory/680-1149-0x0000000003490000-0x00000000034A0000-memory.dmp

Filesize
64KB

Download
memory/680-1147-0x0000000003520000-0x0000000003530000-memory.dmp

Filesize
64KB

Download
memory/680-1144-0x0000000003550000-0x0000000003560000-memory.dmp

Filesize
64KB

Download
memory/680-1143-0x0000000003490000-0x00000000034A0000-memory.dmp

Filesize
64KB

Download
memory/680-1142-0x0000000003490000-0x00000000034A0000-memory.dmp

Filesize
64KB

Download
memory/680-1141-0x0000000003550000-0x0000000003560000-memory.dmp

Filesize
64KB

Download
memory/680-1124-0x0000000009180000-0x0000000009265000-memory.dmp

Filesize
916KB

Download
memory/680-1126-0x0000000009180000-0x0000000009265000-memory.dmp

Filesize
916KB

Download
memory/680-1127-0x0000000003490000-0x00000000034A0000-memory.dmp

Filesize
64KB

Download
memory/680-1128-0x0000000003490000-0x00000000034A0000-memory.dmp

Filesize
64KB

Download
memory/680-1130-0x0000000003490000-0x00000000034A0000-memory.dmp

Filesize
64KB

Download
memory/680-1131-0x0000000003490000-0x00000000034A0000-memory.dmp

Filesize
64KB

Download
memory/680-1129-0x0000000003520000-0x0000000003530000-memory.dmp

Filesize
64KB

Download
memory/680-1132-0x0000000003490000-0x00000000034A0000-memory.dmp

Filesize
64KB

Download
memory/680-1134-0x0000000003490000-0x00000000034A0000-memory.dmp

Filesize
64KB

Download
memory/680-1133-0x0000000003490000-0x00000000034A0000-memory.dmp

Filesize
64KB

Download
memory/680-1136-0x0000000003490000-0x00000000034A0000-memory.dmp

Filesize
64KB

Download
memory/680-1138-0x0000000003490000-0x00000000034A0000-memory.dmp

Filesize
64KB

Download
memory/680-1139-0x0000000003490000-0x00000000034A0000-memory.dmp

Filesize
64KB

Download
memory/680-1140-0x0000000009180000-0x0000000009265000-memory.dmp

Filesize
916KB

Download
memory/3004-1111-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/3004-1092-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/3004-1093-0x0000000077431000-0x0000000077551000-memory.dmp

Filesize
1.1MB

Download
memory/3004-1114-0x0000000001660000-0x0000000005533000-memory.dmp

Filesize
62.8MB

Download
memory/3004-1094-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/3004-1118-0x0000000077431000-0x0000000077551000-memory.dmp

Filesize
1.1MB

Download
memory/3004-1095-0x00000000774B8000-0x00000000774B9000-memory.dmp

Filesize
4KB

Download
memory/3004-1108-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/3004-1109-0x0000000001660000-0x0000000005533000-memory.dmp

Filesize
62.8MB

Download
memory/3004-1110-0x0000000035BF0000-0x0000000035F3A000-memory.dmp

Filesize
3.3MB

Download
memory/3004-1112-0x0000000035A10000-0x0000000035A25000-memory.dmp

Filesize
84KB

Download
memory/4460-1090-0x0000000077431000-0x0000000077551000-memory.dmp

Filesize
1.1MB

Download
memory/4460-1091-0x0000000010000000-0x0000000010006000-memory.dmp

Filesize
24KB

Download
memory/4716-1115-0x0000000000FD0000-0x0000000000FF7000-memory.dmp

Filesize
156KB

Download
memory/4716-1116-0x0000000000FD0000-0x0000000000FF7000-memory.dmp

Filesize
156KB

Download
memory/4716-1117-0x0000000000560000-0x000000000058F000-memory.dmp

Filesize
188KB

Download
memory/4716-1123-0x00000000024B0000-0x0000000002544000-memory.dmp

Filesize
592KB

Download
memory/4716-1120-0x00000000025C0000-0x000000000290A000-memory.dmp

Filesize
3.3MB

Download
memory/4716-1122-0x0000000000560000-0x000000000058F000-memory.dmp

Filesize
188KB

Download