Analysis
-
max time kernel
150s -
max time network
74s -
platform
windows10_x64 -
resource
win10 -
submitted
21-10-2020 10:01
Static task
static1
Behavioral task
behavioral1
Sample
Recu.exe
Resource
win7v200722
Behavioral task
behavioral2
Sample
Recu.exe
Resource
win10
General
-
Target
Recu.exe
-
Size
871KB
-
MD5
fe655433e25918abfbf8d0a748b53ebd
-
SHA1
2481b3aa2a0084a7aa8a5dae26e7a95bd948cd61
-
SHA256
c960f47eb155a0066c0e4e279c296d0516edf66cf032b44188fe3d7f3a16aef6
-
SHA512
7ff96e75adaf8c03f99825bbc93bfe2391934fa71acb2a80cd02a994105497ca76f96f62ea8905409d97c2855ee7fc9a12dd3f4f35f0c8456108925d28023a2d
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
Applicatio.exepid process 2184 Applicatio.exe -
Adds Run key to start application 2 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\ApplicatSTUC = "C:\\Users\\Admin\\AppData\\Roaming\\Applicatio.exe" reg.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\ApplicatSTUC = "C:\\Users\\Admin\\AppData\\Roaming\\Applicatio.exe" reg.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\ApplicatSTUC = "C:\\Users\\Admin\\AppData\\Roaming\\Applicatio.exe" reg.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\ApplicatSTUC = "C:\\Users\\Admin\\AppData\\Roaming\\Applicatio.exe" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\ApplicatSTUC = "C:\\Users\\Admin\\AppData\\Roaming\\Applicatio.exe" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\ApplicatSTUC = "C:\\Users\\Admin\\AppData\\Roaming\\Applicatio.exe" reg.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\ApplicatSTUC = "C:\\Users\\Admin\\AppData\\Roaming\\Applicatio.exe" reg.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\ApplicatSTUC = "C:\\Users\\Admin\\AppData\\Roaming\\Applicatio.exe" reg.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\ApplicatSTUC = "C:\\Users\\Admin\\AppData\\Roaming\\Applicatio.exe" reg.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\ApplicatSTUC = "C:\\Users\\Admin\\AppData\\Roaming\\Applicatio.exe" reg.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\ApplicatSTUC = "C:\\Users\\Admin\\AppData\\Roaming\\Applicatio.exe" reg.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\ApplicatSTUC = "C:\\Users\\Admin\\AppData\\Roaming\\Applicatio.exe" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\ApplicatSTUC = "C:\\Users\\Admin\\AppData\\Roaming\\Applicatio.exe" reg.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\ApplicatSTUC = "C:\\Users\\Admin\\AppData\\Roaming\\Applicatio.exe" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\ApplicatSTUC = "C:\\Users\\Admin\\AppData\\Roaming\\Applicatio.exe" reg.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\ApplicatSTUC = "C:\\Users\\Admin\\AppData\\Roaming\\Applicatio.exe" reg.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\ApplicatSTUC = "C:\\Users\\Admin\\AppData\\Roaming\\Applicatio.exe" reg.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\ApplicatSTUC = "C:\\Users\\Admin\\AppData\\Roaming\\Applicatio.exe" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\ApplicatSTUC = "C:\\Users\\Admin\\AppData\\Roaming\\Applicatio.exe" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\ApplicatSTUC = "C:\\Users\\Admin\\AppData\\Roaming\\Applicatio.exe" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\ApplicatSTUC = "C:\\Users\\Admin\\AppData\\Roaming\\Applicatio.exe" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\ApplicatSTUC = "C:\\Users\\Admin\\AppData\\Roaming\\Applicatio.exe" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\ApplicatSTUC = "C:\\Users\\Admin\\AppData\\Roaming\\Applicatio.exe" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\ApplicatSTUC = "C:\\Users\\Admin\\AppData\\Roaming\\Applicatio.exe" reg.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\ApplicatSTUC = "C:\\Users\\Admin\\AppData\\Roaming\\Applicatio.exe" reg.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\ApplicatSTUC = "C:\\Users\\Admin\\AppData\\Roaming\\Applicatio.exe" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\ApplicatSTUC = "C:\\Users\\Admin\\AppData\\Roaming\\Applicatio.exe" reg.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\ApplicatSTUC = "C:\\Users\\Admin\\AppData\\Roaming\\Applicatio.exe" reg.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\ApplicatSTUC = "C:\\Users\\Admin\\AppData\\Roaming\\Applicatio.exe" reg.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Applicatio.exedescription pid process target process PID 2184 set thread context of 1928 2184 Applicatio.exe mscorsvw.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
Applicatio.exepid process 2184 Applicatio.exe 2184 Applicatio.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Applicatio.exepid process 2184 Applicatio.exe -
Suspicious use of AdjustPrivilegeToken 26 IoCs
Processes:
Recu.exeApplicatio.exemscorsvw.exedescription pid process Token: SeDebugPrivilege 3892 Recu.exe Token: SeDebugPrivilege 2184 Applicatio.exe Token: SeIncreaseQuotaPrivilege 1928 mscorsvw.exe Token: SeSecurityPrivilege 1928 mscorsvw.exe Token: SeTakeOwnershipPrivilege 1928 mscorsvw.exe Token: SeLoadDriverPrivilege 1928 mscorsvw.exe Token: SeSystemProfilePrivilege 1928 mscorsvw.exe Token: SeSystemtimePrivilege 1928 mscorsvw.exe Token: SeProfSingleProcessPrivilege 1928 mscorsvw.exe Token: SeIncBasePriorityPrivilege 1928 mscorsvw.exe Token: SeCreatePagefilePrivilege 1928 mscorsvw.exe Token: SeBackupPrivilege 1928 mscorsvw.exe Token: SeRestorePrivilege 1928 mscorsvw.exe Token: SeShutdownPrivilege 1928 mscorsvw.exe Token: SeDebugPrivilege 1928 mscorsvw.exe Token: SeSystemEnvironmentPrivilege 1928 mscorsvw.exe Token: SeChangeNotifyPrivilege 1928 mscorsvw.exe Token: SeRemoteShutdownPrivilege 1928 mscorsvw.exe Token: SeUndockPrivilege 1928 mscorsvw.exe Token: SeManageVolumePrivilege 1928 mscorsvw.exe Token: SeImpersonatePrivilege 1928 mscorsvw.exe Token: SeCreateGlobalPrivilege 1928 mscorsvw.exe Token: 33 1928 mscorsvw.exe Token: 34 1928 mscorsvw.exe Token: 35 1928 mscorsvw.exe Token: 36 1928 mscorsvw.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
mscorsvw.exepid process 1928 mscorsvw.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
Recu.execmd.exeApplicatio.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exedescription pid process target process PID 3892 wrote to memory of 2452 3892 Recu.exe cmd.exe PID 3892 wrote to memory of 2452 3892 Recu.exe cmd.exe PID 3892 wrote to memory of 2452 3892 Recu.exe cmd.exe PID 3892 wrote to memory of 1828 3892 Recu.exe cmd.exe PID 3892 wrote to memory of 1828 3892 Recu.exe cmd.exe PID 3892 wrote to memory of 1828 3892 Recu.exe cmd.exe PID 1828 wrote to memory of 2184 1828 cmd.exe Applicatio.exe PID 1828 wrote to memory of 2184 1828 cmd.exe Applicatio.exe PID 1828 wrote to memory of 2184 1828 cmd.exe Applicatio.exe PID 2184 wrote to memory of 736 2184 Applicatio.exe cmd.exe PID 2184 wrote to memory of 736 2184 Applicatio.exe cmd.exe PID 2184 wrote to memory of 736 2184 Applicatio.exe cmd.exe PID 736 wrote to memory of 8 736 cmd.exe reg.exe PID 736 wrote to memory of 8 736 cmd.exe reg.exe PID 736 wrote to memory of 8 736 cmd.exe reg.exe PID 2184 wrote to memory of 3296 2184 Applicatio.exe cmd.exe PID 2184 wrote to memory of 3296 2184 Applicatio.exe cmd.exe PID 2184 wrote to memory of 3296 2184 Applicatio.exe cmd.exe PID 2184 wrote to memory of 1928 2184 Applicatio.exe mscorsvw.exe PID 2184 wrote to memory of 1928 2184 Applicatio.exe mscorsvw.exe PID 2184 wrote to memory of 1928 2184 Applicatio.exe mscorsvw.exe PID 3296 wrote to memory of 1312 3296 cmd.exe reg.exe PID 3296 wrote to memory of 1312 3296 cmd.exe reg.exe PID 3296 wrote to memory of 1312 3296 cmd.exe reg.exe PID 2184 wrote to memory of 1928 2184 Applicatio.exe mscorsvw.exe PID 2184 wrote to memory of 1928 2184 Applicatio.exe mscorsvw.exe PID 2184 wrote to memory of 1928 2184 Applicatio.exe mscorsvw.exe PID 2184 wrote to memory of 1928 2184 Applicatio.exe mscorsvw.exe PID 2184 wrote to memory of 1928 2184 Applicatio.exe mscorsvw.exe PID 2184 wrote to memory of 1928 2184 Applicatio.exe mscorsvw.exe PID 2184 wrote to memory of 1928 2184 Applicatio.exe mscorsvw.exe PID 2184 wrote to memory of 1928 2184 Applicatio.exe mscorsvw.exe PID 2184 wrote to memory of 1928 2184 Applicatio.exe mscorsvw.exe PID 2184 wrote to memory of 2100 2184 Applicatio.exe cmd.exe PID 2184 wrote to memory of 2100 2184 Applicatio.exe cmd.exe PID 2184 wrote to memory of 2100 2184 Applicatio.exe cmd.exe PID 2100 wrote to memory of 2520 2100 cmd.exe reg.exe PID 2100 wrote to memory of 2520 2100 cmd.exe reg.exe PID 2100 wrote to memory of 2520 2100 cmd.exe reg.exe PID 2184 wrote to memory of 3768 2184 Applicatio.exe cmd.exe PID 2184 wrote to memory of 3768 2184 Applicatio.exe cmd.exe PID 2184 wrote to memory of 3768 2184 Applicatio.exe cmd.exe PID 3768 wrote to memory of 2008 3768 cmd.exe reg.exe PID 3768 wrote to memory of 2008 3768 cmd.exe reg.exe PID 3768 wrote to memory of 2008 3768 cmd.exe reg.exe PID 2184 wrote to memory of 1604 2184 Applicatio.exe cmd.exe PID 2184 wrote to memory of 1604 2184 Applicatio.exe cmd.exe PID 2184 wrote to memory of 1604 2184 Applicatio.exe cmd.exe PID 1604 wrote to memory of 2508 1604 cmd.exe reg.exe PID 1604 wrote to memory of 2508 1604 cmd.exe reg.exe PID 1604 wrote to memory of 2508 1604 cmd.exe reg.exe PID 2184 wrote to memory of 1692 2184 Applicatio.exe cmd.exe PID 2184 wrote to memory of 1692 2184 Applicatio.exe cmd.exe PID 2184 wrote to memory of 1692 2184 Applicatio.exe cmd.exe PID 1692 wrote to memory of 2600 1692 cmd.exe reg.exe PID 1692 wrote to memory of 2600 1692 cmd.exe reg.exe PID 1692 wrote to memory of 2600 1692 cmd.exe reg.exe PID 2184 wrote to memory of 3048 2184 Applicatio.exe cmd.exe PID 2184 wrote to memory of 3048 2184 Applicatio.exe cmd.exe PID 2184 wrote to memory of 3048 2184 Applicatio.exe cmd.exe PID 3048 wrote to memory of 2448 3048 cmd.exe reg.exe PID 3048 wrote to memory of 2448 3048 cmd.exe reg.exe PID 3048 wrote to memory of 2448 3048 cmd.exe reg.exe PID 2184 wrote to memory of 1800 2184 Applicatio.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Recu.exe"C:\Users\Admin\AppData\Local\Temp\Recu.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3892 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\Recu.exe" "C:\Users\Admin\AppData\Roaming\Applicatio.exe"2⤵PID:2452
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c, "C:\Users\Admin\AppData\Roaming\Applicatio.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1828 -
C:\Users\Admin\AppData\Roaming\Applicatio.exe"C:\Users\Admin\AppData\Roaming\Applicatio.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵
- Suspicious use of WriteProcessMemory
PID:736 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵
- Adds Run key to start application
PID:8 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵
- Suspicious use of WriteProcessMemory
PID:3296 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵PID:1312
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe"4⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1928 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵
- Adds Run key to start application
PID:2520 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵
- Suspicious use of WriteProcessMemory
PID:3768 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵
- Adds Run key to start application
PID:2008 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵
- Suspicious use of WriteProcessMemory
PID:1604 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵
- Adds Run key to start application
PID:2508 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵
- Adds Run key to start application
PID:2600 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵
- Adds Run key to start application
PID:2448 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵PID:1800
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵PID:2476
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵PID:3840
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵
- Adds Run key to start application
PID:3224 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵PID:2136
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵
- Adds Run key to start application
PID:3832 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵PID:1512
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵PID:3744
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵PID:3352
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵PID:2996
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵PID:1116
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵
- Adds Run key to start application
PID:3632 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵PID:2096
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵
- Adds Run key to start application
PID:3780 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵PID:1144
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵PID:3604
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵PID:1660
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵
- Adds Run key to start application
PID:2652 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵PID:2644
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵PID:2708
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵PID:2132
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵
- Adds Run key to start application
PID:2640 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵PID:3608
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵
- Adds Run key to start application
PID:3192 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵PID:1168
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵PID:2728
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵PID:1716
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵
- Adds Run key to start application
PID:1276 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵PID:4040
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵
- Adds Run key to start application
PID:1112 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵PID:2360
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵PID:3764
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵PID:1736
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵
- Adds Run key to start application
PID:1584 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵PID:2496
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵PID:2544
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵PID:2616
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵PID:1944
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵PID:2392
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵PID:3640
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵PID:3900
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵
- Adds Run key to start application
PID:1184 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵PID:2532
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵
- Adds Run key to start application
PID:3312 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵PID:4004
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵
- Adds Run key to start application
PID:2364 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵PID:3904
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵
- Adds Run key to start application
PID:1124 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵PID:1064
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵
- Adds Run key to start application
PID:2484 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵PID:2724
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵
- Adds Run key to start application
PID:352 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵PID:380
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵PID:3668
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵PID:2176
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵
- Adds Run key to start application
PID:3020 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵PID:196
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵
- Adds Run key to start application
PID:2104 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵PID:1748
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵
- Adds Run key to start application
PID:1164 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵PID:2676
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵
- Adds Run key to start application
PID:1252 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵PID:2464
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵
- Adds Run key to start application
PID:2156 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵PID:3984
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵
- Adds Run key to start application
PID:3256 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵PID:2180
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵PID:2076
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵PID:2480
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵
- Adds Run key to start application
PID:1180 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵PID:3460
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵PID:3012
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵PID:3496
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵
- Adds Run key to start application
PID:3232 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵PID:2208
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵
- Adds Run key to start application
PID:3836 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵PID:2680
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵PID:2648
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵PID:2516
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵PID:1424
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵PID:188
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵PID:3936
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵PID:1504
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵
- Adds Run key to start application
PID:3888 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵PID:2468
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵PID:2884
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵PID:3512
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵PID:2892
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵PID:2032
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵
- Adds Run key to start application
PID:1576 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵PID:2432
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵PID:3568
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵PID:3992
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵
- Adds Run key to start application
PID:2080 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵PID:664
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵
- Adds Run key to start application
PID:492 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵PID:4000
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵PID:3752
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵PID:1860
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵
- Adds Run key to start application
PID:2396 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵PID:1044
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵
- Adds Run key to start application
PID:3360 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵PID:4064
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵PID:1824
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵PID:1080
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵PID:2064
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵PID:2584
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵PID:3044
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵PID:2572
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵PID:1372
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵PID:1196
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵
- Adds Run key to start application
PID:2984 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵PID:3464
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵PID:2108
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵PID:4116
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵PID:4160
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵PID:4184
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵PID:4228
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵PID:4252
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵PID:4296
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵PID:4320
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵
- Adds Run key to start application
PID:4364 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵PID:4388
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵PID:4432
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵PID:4456
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵
- Adds Run key to start application
PID:4500 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵PID:4524
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵PID:4568
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵PID:4592
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵PID:4636
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵PID:4660
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵
- Adds Run key to start application
PID:4704 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵PID:4728
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵PID:4772
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵PID:4796
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵PID:4840
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵PID:4864
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵
- Adds Run key to start application
PID:4908 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵PID:4932
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵PID:4976
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵PID:5000
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵
- Adds Run key to start application
PID:5044 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵PID:5068
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵
- Adds Run key to start application
PID:5112 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵PID:1676
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵
- Adds Run key to start application
PID:4164 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵PID:4120
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵
- Adds Run key to start application
PID:4224 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵PID:4204
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵
- Adds Run key to start application
PID:4288 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵PID:4336
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵
- Adds Run key to start application
PID:4340 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵PID:4444
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵PID:4472
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵PID:4496
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵PID:4580
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵PID:4544
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵
- Adds Run key to start application
PID:4620 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵PID:4604
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵PID:4680
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵PID:4788
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵
- Adds Run key to start application
PID:4740 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵PID:4852
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵PID:4916
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵PID:4896
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵PID:4988
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵PID:4968
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵
- Adds Run key to start application
PID:5032 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵PID:5076
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵
- Adds Run key to start application
PID:5104 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵PID:4176
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵
- Adds Run key to start application
PID:4152
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Applicatio.exeMD5
fe655433e25918abfbf8d0a748b53ebd
SHA12481b3aa2a0084a7aa8a5dae26e7a95bd948cd61
SHA256c960f47eb155a0066c0e4e279c296d0516edf66cf032b44188fe3d7f3a16aef6
SHA5127ff96e75adaf8c03f99825bbc93bfe2391934fa71acb2a80cd02a994105497ca76f96f62ea8905409d97c2855ee7fc9a12dd3f4f35f0c8456108925d28023a2d
-
C:\Users\Admin\AppData\Roaming\Applicatio.exeMD5
fe655433e25918abfbf8d0a748b53ebd
SHA12481b3aa2a0084a7aa8a5dae26e7a95bd948cd61
SHA256c960f47eb155a0066c0e4e279c296d0516edf66cf032b44188fe3d7f3a16aef6
SHA5127ff96e75adaf8c03f99825bbc93bfe2391934fa71acb2a80cd02a994105497ca76f96f62ea8905409d97c2855ee7fc9a12dd3f4f35f0c8456108925d28023a2d
-
memory/8-22-0x0000000000000000-mapping.dmp
-
memory/188-120-0x0000000000000000-mapping.dmp
-
memory/196-96-0x0000000000000000-mapping.dmp
-
memory/352-91-0x0000000000000000-mapping.dmp
-
memory/380-92-0x0000000000000000-mapping.dmp
-
memory/492-135-0x0000000000000000-mapping.dmp
-
memory/664-134-0x0000000000000000-mapping.dmp
-
memory/736-21-0x0000000000000000-mapping.dmp
-
memory/1044-140-0x0000000000000000-mapping.dmp
-
memory/1064-88-0x0000000000000000-mapping.dmp
-
memory/1080-144-0x0000000000000000-mapping.dmp
-
memory/1112-69-0x0000000000000000-mapping.dmp
-
memory/1116-50-0x0000000000000000-mapping.dmp
-
memory/1124-87-0x0000000000000000-mapping.dmp
-
memory/1144-54-0x0000000000000000-mapping.dmp
-
memory/1164-99-0x0000000000000000-mapping.dmp
-
memory/1168-64-0x0000000000000000-mapping.dmp
-
memory/1180-109-0x0000000000000000-mapping.dmp
-
memory/1184-81-0x0000000000000000-mapping.dmp
-
memory/1196-150-0x0000000000000000-mapping.dmp
-
memory/1252-101-0x0000000000000000-mapping.dmp
-
memory/1276-67-0x0000000000000000-mapping.dmp
-
memory/1312-26-0x0000000000000000-mapping.dmp
-
memory/1372-149-0x0000000000000000-mapping.dmp
-
memory/1424-119-0x0000000000000000-mapping.dmp
-
memory/1504-122-0x0000000000000000-mapping.dmp
-
memory/1512-46-0x0000000000000000-mapping.dmp
-
memory/1576-129-0x0000000000000000-mapping.dmp
-
memory/1584-73-0x0000000000000000-mapping.dmp
-
memory/1604-34-0x0000000000000000-mapping.dmp
-
memory/1660-56-0x0000000000000000-mapping.dmp
-
memory/1676-184-0x0000000000000000-mapping.dmp
-
memory/1692-36-0x0000000000000000-mapping.dmp
-
memory/1716-66-0x0000000000000000-mapping.dmp
-
memory/1736-72-0x0000000000000000-mapping.dmp
-
memory/1748-98-0x0000000000000000-mapping.dmp
-
memory/1800-40-0x0000000000000000-mapping.dmp
-
memory/1824-143-0x0000000000000000-mapping.dmp
-
memory/1828-9-0x0000000000000000-mapping.dmp
-
memory/1860-138-0x0000000000000000-mapping.dmp
-
memory/1928-33-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1928-30-0x000000000048F888-mapping.dmp
-
memory/1928-29-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1944-77-0x0000000000000000-mapping.dmp
-
memory/2008-32-0x0000000000000000-mapping.dmp
-
memory/2032-128-0x0000000000000000-mapping.dmp
-
memory/2064-145-0x0000000000000000-mapping.dmp
-
memory/2076-107-0x0000000000000000-mapping.dmp
-
memory/2080-133-0x0000000000000000-mapping.dmp
-
memory/2096-52-0x0000000000000000-mapping.dmp
-
memory/2100-27-0x0000000000000000-mapping.dmp
-
memory/2104-97-0x0000000000000000-mapping.dmp
-
memory/2108-153-0x0000000000000000-mapping.dmp
-
memory/2132-60-0x0000000000000000-mapping.dmp
-
memory/2136-44-0x0000000000000000-mapping.dmp
-
memory/2156-103-0x0000000000000000-mapping.dmp
-
memory/2176-94-0x0000000000000000-mapping.dmp
-
memory/2180-106-0x0000000000000000-mapping.dmp
-
memory/2184-25-0x0000000008B70000-0x0000000008B71000-memory.dmpFilesize
4KB
-
memory/2184-23-0x0000000008C90000-0x0000000008C9A000-memory.dmpFilesize
40KB
-
memory/2184-13-0x0000000073D70000-0x000000007445E000-memory.dmpFilesize
6.9MB
-
memory/2184-10-0x0000000000000000-mapping.dmp
-
memory/2208-114-0x0000000000000000-mapping.dmp
-
memory/2360-70-0x0000000000000000-mapping.dmp
-
memory/2364-85-0x0000000000000000-mapping.dmp
-
memory/2392-78-0x0000000000000000-mapping.dmp
-
memory/2396-139-0x0000000000000000-mapping.dmp
-
memory/2432-130-0x0000000000000000-mapping.dmp
-
memory/2448-39-0x0000000000000000-mapping.dmp
-
memory/2452-8-0x0000000000000000-mapping.dmp
-
memory/2464-102-0x0000000000000000-mapping.dmp
-
memory/2468-124-0x0000000000000000-mapping.dmp
-
memory/2476-41-0x0000000000000000-mapping.dmp
-
memory/2480-108-0x0000000000000000-mapping.dmp
-
memory/2484-89-0x0000000000000000-mapping.dmp
-
memory/2496-74-0x0000000000000000-mapping.dmp
-
memory/2508-35-0x0000000000000000-mapping.dmp
-
memory/2516-118-0x0000000000000000-mapping.dmp
-
memory/2520-28-0x0000000000000000-mapping.dmp
-
memory/2532-82-0x0000000000000000-mapping.dmp
-
memory/2544-75-0x0000000000000000-mapping.dmp
-
memory/2572-148-0x0000000000000000-mapping.dmp
-
memory/2584-146-0x0000000000000000-mapping.dmp
-
memory/2600-37-0x0000000000000000-mapping.dmp
-
memory/2616-76-0x0000000000000000-mapping.dmp
-
memory/2640-61-0x0000000000000000-mapping.dmp
-
memory/2644-58-0x0000000000000000-mapping.dmp
-
memory/2648-117-0x0000000000000000-mapping.dmp
-
memory/2652-57-0x0000000000000000-mapping.dmp
-
memory/2676-100-0x0000000000000000-mapping.dmp
-
memory/2680-116-0x0000000000000000-mapping.dmp
-
memory/2708-59-0x0000000000000000-mapping.dmp
-
memory/2724-90-0x0000000000000000-mapping.dmp
-
memory/2728-65-0x0000000000000000-mapping.dmp
-
memory/2884-125-0x0000000000000000-mapping.dmp
-
memory/2892-127-0x0000000000000000-mapping.dmp
-
memory/2984-151-0x0000000000000000-mapping.dmp
-
memory/2996-49-0x0000000000000000-mapping.dmp
-
memory/3012-111-0x0000000000000000-mapping.dmp
-
memory/3020-95-0x0000000000000000-mapping.dmp
-
memory/3044-147-0x0000000000000000-mapping.dmp
-
memory/3048-38-0x0000000000000000-mapping.dmp
-
memory/3192-63-0x0000000000000000-mapping.dmp
-
memory/3224-43-0x0000000000000000-mapping.dmp
-
memory/3232-113-0x0000000000000000-mapping.dmp
-
memory/3256-105-0x0000000000000000-mapping.dmp
-
memory/3296-24-0x0000000000000000-mapping.dmp
-
memory/3312-83-0x0000000000000000-mapping.dmp
-
memory/3352-48-0x0000000000000000-mapping.dmp
-
memory/3360-141-0x0000000000000000-mapping.dmp
-
memory/3460-110-0x0000000000000000-mapping.dmp
-
memory/3464-152-0x0000000000000000-mapping.dmp
-
memory/3496-112-0x0000000000000000-mapping.dmp
-
memory/3512-126-0x0000000000000000-mapping.dmp
-
memory/3568-131-0x0000000000000000-mapping.dmp
-
memory/3604-55-0x0000000000000000-mapping.dmp
-
memory/3608-62-0x0000000000000000-mapping.dmp
-
memory/3632-51-0x0000000000000000-mapping.dmp
-
memory/3640-79-0x0000000000000000-mapping.dmp
-
memory/3668-93-0x0000000000000000-mapping.dmp
-
memory/3744-47-0x0000000000000000-mapping.dmp
-
memory/3752-137-0x0000000000000000-mapping.dmp
-
memory/3764-71-0x0000000000000000-mapping.dmp
-
memory/3768-31-0x0000000000000000-mapping.dmp
-
memory/3780-53-0x0000000000000000-mapping.dmp
-
memory/3832-45-0x0000000000000000-mapping.dmp
-
memory/3836-115-0x0000000000000000-mapping.dmp
-
memory/3840-42-0x0000000000000000-mapping.dmp
-
memory/3888-123-0x0000000000000000-mapping.dmp
-
memory/3892-3-0x0000000005470000-0x0000000005471000-memory.dmpFilesize
4KB
-
memory/3892-7-0x0000000007D20000-0x0000000007D21000-memory.dmpFilesize
4KB
-
memory/3892-0-0x0000000073D70000-0x000000007445E000-memory.dmpFilesize
6.9MB
-
memory/3892-1-0x0000000000B00000-0x0000000000B01000-memory.dmpFilesize
4KB
-
memory/3892-4-0x0000000002DD0000-0x0000000002DE7000-memory.dmpFilesize
92KB
-
memory/3892-5-0x0000000002E00000-0x0000000002E1F000-memory.dmpFilesize
124KB
-
memory/3892-6-0x0000000008140000-0x0000000008141000-memory.dmpFilesize
4KB
-
memory/3900-80-0x0000000000000000-mapping.dmp
-
memory/3904-86-0x0000000000000000-mapping.dmp
-
memory/3936-121-0x0000000000000000-mapping.dmp
-
memory/3984-104-0x0000000000000000-mapping.dmp
-
memory/3992-132-0x0000000000000000-mapping.dmp
-
memory/4000-136-0x0000000000000000-mapping.dmp
-
memory/4004-84-0x0000000000000000-mapping.dmp
-
memory/4040-68-0x0000000000000000-mapping.dmp
-
memory/4064-142-0x0000000000000000-mapping.dmp
-
memory/4116-154-0x0000000000000000-mapping.dmp
-
memory/4120-186-0x0000000000000000-mapping.dmp
-
memory/4152-211-0x0000000000000000-mapping.dmp
-
memory/4160-155-0x0000000000000000-mapping.dmp
-
memory/4164-185-0x0000000000000000-mapping.dmp
-
memory/4176-210-0x0000000000000000-mapping.dmp
-
memory/4184-156-0x0000000000000000-mapping.dmp
-
memory/4204-188-0x0000000000000000-mapping.dmp
-
memory/4224-187-0x0000000000000000-mapping.dmp
-
memory/4228-157-0x0000000000000000-mapping.dmp
-
memory/4252-158-0x0000000000000000-mapping.dmp
-
memory/4288-189-0x0000000000000000-mapping.dmp
-
memory/4296-159-0x0000000000000000-mapping.dmp
-
memory/4320-160-0x0000000000000000-mapping.dmp
-
memory/4336-190-0x0000000000000000-mapping.dmp
-
memory/4340-191-0x0000000000000000-mapping.dmp
-
memory/4364-161-0x0000000000000000-mapping.dmp
-
memory/4388-162-0x0000000000000000-mapping.dmp
-
memory/4432-163-0x0000000000000000-mapping.dmp
-
memory/4444-192-0x0000000000000000-mapping.dmp
-
memory/4456-164-0x0000000000000000-mapping.dmp
-
memory/4472-193-0x0000000000000000-mapping.dmp
-
memory/4496-194-0x0000000000000000-mapping.dmp
-
memory/4500-165-0x0000000000000000-mapping.dmp
-
memory/4524-166-0x0000000000000000-mapping.dmp
-
memory/4544-196-0x0000000000000000-mapping.dmp
-
memory/4568-167-0x0000000000000000-mapping.dmp
-
memory/4580-195-0x0000000000000000-mapping.dmp
-
memory/4592-168-0x0000000000000000-mapping.dmp
-
memory/4604-198-0x0000000000000000-mapping.dmp
-
memory/4620-197-0x0000000000000000-mapping.dmp
-
memory/4636-169-0x0000000000000000-mapping.dmp
-
memory/4660-170-0x0000000000000000-mapping.dmp
-
memory/4680-199-0x0000000000000000-mapping.dmp
-
memory/4704-171-0x0000000000000000-mapping.dmp
-
memory/4728-172-0x0000000000000000-mapping.dmp
-
memory/4740-201-0x0000000000000000-mapping.dmp
-
memory/4772-173-0x0000000000000000-mapping.dmp
-
memory/4788-200-0x0000000000000000-mapping.dmp
-
memory/4796-174-0x0000000000000000-mapping.dmp
-
memory/4840-175-0x0000000000000000-mapping.dmp
-
memory/4852-202-0x0000000000000000-mapping.dmp
-
memory/4864-176-0x0000000000000000-mapping.dmp
-
memory/4896-204-0x0000000000000000-mapping.dmp
-
memory/4908-177-0x0000000000000000-mapping.dmp
-
memory/4916-203-0x0000000000000000-mapping.dmp
-
memory/4932-178-0x0000000000000000-mapping.dmp
-
memory/4968-206-0x0000000000000000-mapping.dmp
-
memory/4976-179-0x0000000000000000-mapping.dmp
-
memory/4988-205-0x0000000000000000-mapping.dmp
-
memory/5000-180-0x0000000000000000-mapping.dmp
-
memory/5032-207-0x0000000000000000-mapping.dmp
-
memory/5044-181-0x0000000000000000-mapping.dmp
-
memory/5068-182-0x0000000000000000-mapping.dmp
-
memory/5076-208-0x0000000000000000-mapping.dmp
-
memory/5104-209-0x0000000000000000-mapping.dmp
-
memory/5112-183-0x0000000000000000-mapping.dmp