Resubmissions

07-07-2022 07:38

220707-jgnwpafbfn 10

02-11-2020 14:43

201102-qmzdv5yy92 8

Analysis

  • max time kernel
    151s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    02-11-2020 14:43

General

  • Target

    Booking Confirmation591773251.exe

  • Size

    926KB

  • MD5

    d36537604871b3550a9c5c635c37a601

  • SHA1

    a5360105e7b4d5316c88e5403013dd395c1ab145

  • SHA256

    4f3145508f4292ca3bfb6d9d4284b50df0834743676e6b951e71b4248d0d1a72

  • SHA512

    8b0c31bae27b95ee726fb77a2e0c6b82e599f73ad93d0fcf8c853cca2daf285796d0175ea1d5e0cfb3a40d5b80958a6c1d821b10eb241cba95a7c909ffe04df9

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 158 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 660 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Booking Confirmation591773251.exe
    "C:\Users\Admin\AppData\Local\Temp\Booking Confirmation591773251.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:844
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\Booking Confirmation591773251.exe" "C:\Users\Admin\AppData\Roaming\system\images.exe"
      2⤵
        PID:1448
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c, "C:\Users\Admin\AppData\Roaming\system\images.exe"
        2⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:1668
        • C:\Users\Admin\AppData\Roaming\system\images.exe
          "C:\Users\Admin\AppData\Roaming\system\images.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1268
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:1436
            • C:\Windows\SysWOW64\reg.exe
              REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
              5⤵
              • Adds Run key to start application
              PID:1404
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:1624
            • C:\Windows\SysWOW64\reg.exe
              REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
              5⤵
              • Adds Run key to start application
              PID:1900
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
            4⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1220
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:1864
            • C:\Windows\SysWOW64\reg.exe
              REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
              5⤵
              • Adds Run key to start application
              PID:912
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:944
            • C:\Windows\SysWOW64\reg.exe
              REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
              5⤵
              • Adds Run key to start application
              PID:968
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
            4⤵
              PID:2012
              • C:\Windows\SysWOW64\reg.exe
                REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                5⤵
                • Adds Run key to start application
                PID:560
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
              4⤵
                PID:960
                • C:\Windows\SysWOW64\reg.exe
                  REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                  5⤵
                  • Adds Run key to start application
                  PID:1460
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                4⤵
                  PID:1724
                  • C:\Windows\SysWOW64\reg.exe
                    REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                    5⤵
                    • Adds Run key to start application
                    PID:1928
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                  4⤵
                    PID:1004
                    • C:\Windows\SysWOW64\reg.exe
                      REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                      5⤵
                        PID:1420
                    • C:\Windows\SysWOW64\cmd.exe
                      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                      4⤵
                        PID:1236
                        • C:\Windows\SysWOW64\reg.exe
                          REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                          5⤵
                          • Adds Run key to start application
                          PID:832
                      • C:\Windows\SysWOW64\cmd.exe
                        "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                        4⤵
                          PID:1908
                          • C:\Windows\SysWOW64\reg.exe
                            REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                            5⤵
                            • Adds Run key to start application
                            PID:1112
                        • C:\Windows\SysWOW64\cmd.exe
                          "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                          4⤵
                            PID:1396
                            • C:\Windows\SysWOW64\reg.exe
                              REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                              5⤵
                              • Adds Run key to start application
                              PID:1860
                          • C:\Windows\SysWOW64\cmd.exe
                            "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                            4⤵
                              PID:1596
                              • C:\Windows\SysWOW64\reg.exe
                                REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                5⤵
                                • Adds Run key to start application
                                PID:560
                            • C:\Windows\SysWOW64\cmd.exe
                              "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                              4⤵
                                PID:1704
                                • C:\Windows\SysWOW64\reg.exe
                                  REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                  5⤵
                                  • Adds Run key to start application
                                  PID:1084
                              • C:\Windows\SysWOW64\cmd.exe
                                "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                4⤵
                                  PID:1124
                                  • C:\Windows\SysWOW64\reg.exe
                                    REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                    5⤵
                                      PID:820
                                  • C:\Windows\SysWOW64\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                    4⤵
                                      PID:1272
                                      • C:\Windows\SysWOW64\reg.exe
                                        REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                        5⤵
                                          PID:1644
                                      • C:\Windows\SysWOW64\cmd.exe
                                        "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                        4⤵
                                          PID:1428
                                          • C:\Windows\SysWOW64\reg.exe
                                            REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                            5⤵
                                            • Adds Run key to start application
                                            PID:1956
                                        • C:\Windows\SysWOW64\cmd.exe
                                          "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                          4⤵
                                            PID:1112
                                            • C:\Windows\SysWOW64\reg.exe
                                              REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                              5⤵
                                                PID:1688
                                            • C:\Windows\SysWOW64\cmd.exe
                                              "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                              4⤵
                                                PID:936
                                                • C:\Windows\SysWOW64\reg.exe
                                                  REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                  5⤵
                                                  • Adds Run key to start application
                                                  PID:560
                                              • C:\Windows\SysWOW64\cmd.exe
                                                "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                4⤵
                                                  PID:1692
                                                  • C:\Windows\SysWOW64\reg.exe
                                                    REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                    5⤵
                                                    • Adds Run key to start application
                                                    PID:620
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                  4⤵
                                                    PID:884
                                                    • C:\Windows\SysWOW64\reg.exe
                                                      REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                      5⤵
                                                        PID:1944
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                      4⤵
                                                        PID:1324
                                                        • C:\Windows\SysWOW64\reg.exe
                                                          REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                          5⤵
                                                          • Adds Run key to start application
                                                          PID:1576
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                        4⤵
                                                          PID:1732
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                            5⤵
                                                              PID:940
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                            4⤵
                                                              PID:1784
                                                              • C:\Windows\SysWOW64\reg.exe
                                                                REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                5⤵
                                                                  PID:452
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                4⤵
                                                                  PID:684
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                    5⤵
                                                                    • Adds Run key to start application
                                                                    PID:1980
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                  4⤵
                                                                    PID:1740
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                      5⤵
                                                                      • Adds Run key to start application
                                                                      PID:1644
                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                    "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                    4⤵
                                                                      PID:1576
                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                        REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                        5⤵
                                                                        • Adds Run key to start application
                                                                        PID:108
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                      4⤵
                                                                        PID:1688
                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                          REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                          5⤵
                                                                          • Adds Run key to start application
                                                                          PID:1588
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                        4⤵
                                                                          PID:560
                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                            REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                            5⤵
                                                                              PID:1132
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                            4⤵
                                                                              PID:912
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                5⤵
                                                                                  PID:1420
                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                4⤵
                                                                                  PID:908
                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                    REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                    5⤵
                                                                                    • Adds Run key to start application
                                                                                    PID:1984
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                  4⤵
                                                                                    PID:1676
                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                      REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                      5⤵
                                                                                        PID:1504
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                      4⤵
                                                                                        PID:1816
                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                          REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                          5⤵
                                                                                          • Adds Run key to start application
                                                                                          PID:620
                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                        "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                        4⤵
                                                                                          PID:1892
                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                            REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                            5⤵
                                                                                              PID:1404
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                            4⤵
                                                                                              PID:1984
                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                5⤵
                                                                                                • Adds Run key to start application
                                                                                                PID:1520
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                              4⤵
                                                                                                PID:1972
                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                  REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                  5⤵
                                                                                                    PID:620
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                  4⤵
                                                                                                    PID:1980
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                      5⤵
                                                                                                      • Adds Run key to start application
                                                                                                      PID:864
                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                    "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                    4⤵
                                                                                                      PID:2004
                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                        REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                        5⤵
                                                                                                          PID:1452
                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                        "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                        4⤵
                                                                                                          PID:1460
                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                            REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                            5⤵
                                                                                                            • Adds Run key to start application
                                                                                                            PID:1420
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                          4⤵
                                                                                                            PID:864
                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                              REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                              5⤵
                                                                                                              • Adds Run key to start application
                                                                                                              PID:1588
                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                            "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                            4⤵
                                                                                                              PID:108
                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                5⤵
                                                                                                                  PID:1420
                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                4⤵
                                                                                                                  PID:1584
                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                    REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                    5⤵
                                                                                                                    • Adds Run key to start application
                                                                                                                    PID:1404
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                  4⤵
                                                                                                                    PID:1860
                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                      REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                      5⤵
                                                                                                                        PID:1612
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                      4⤵
                                                                                                                        PID:1032
                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                          REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                          5⤵
                                                                                                                            PID:1628
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                          4⤵
                                                                                                                            PID:1612
                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                              REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                              5⤵
                                                                                                                              • Adds Run key to start application
                                                                                                                              PID:1968
                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                            "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                            4⤵
                                                                                                                              PID:1588
                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                5⤵
                                                                                                                                  PID:916
                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                4⤵
                                                                                                                                  PID:940
                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                    REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                    5⤵
                                                                                                                                      PID:1968
                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                    "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                    4⤵
                                                                                                                                      PID:1404
                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                        REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                        5⤵
                                                                                                                                        • Adds Run key to start application
                                                                                                                                        PID:1224
                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                      4⤵
                                                                                                                                        PID:1968
                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                          REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                          5⤵
                                                                                                                                          • Adds Run key to start application
                                                                                                                                          PID:1084
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                        4⤵
                                                                                                                                          PID:2060
                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                            REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                            5⤵
                                                                                                                                            • Adds Run key to start application
                                                                                                                                            PID:2088
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                          4⤵
                                                                                                                                            PID:2104
                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                              REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                              5⤵
                                                                                                                                              • Adds Run key to start application
                                                                                                                                              PID:2132
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                            4⤵
                                                                                                                                              PID:2148
                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                5⤵
                                                                                                                                                  PID:2176
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                4⤵
                                                                                                                                                  PID:2192
                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                    REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                    5⤵
                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                    PID:2220
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                  4⤵
                                                                                                                                                    PID:2236
                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                      REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                      5⤵
                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                      PID:2264
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                    4⤵
                                                                                                                                                      PID:2280
                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                        REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                        5⤵
                                                                                                                                                        • Adds Run key to start application
                                                                                                                                                        PID:2308
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                      4⤵
                                                                                                                                                        PID:2324
                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                          REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                          5⤵
                                                                                                                                                            PID:2352
                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                          "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                          4⤵
                                                                                                                                                            PID:2368
                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                              REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                              5⤵
                                                                                                                                                                PID:2396
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                              4⤵
                                                                                                                                                                PID:2416
                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                  REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                  5⤵
                                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                                  PID:2444
                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                4⤵
                                                                                                                                                                  PID:2460
                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                    REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                    5⤵
                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                    PID:2488
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                  4⤵
                                                                                                                                                                    PID:2504
                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                      REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                      5⤵
                                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                                      PID:2532
                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                    4⤵
                                                                                                                                                                      PID:2548
                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                        REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                        5⤵
                                                                                                                                                                        • Adds Run key to start application
                                                                                                                                                                        PID:2576
                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                      4⤵
                                                                                                                                                                        PID:2592
                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                          REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                          5⤵
                                                                                                                                                                          • Adds Run key to start application
                                                                                                                                                                          PID:2620
                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                        4⤵
                                                                                                                                                                          PID:2636
                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                            REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                            5⤵
                                                                                                                                                                            • Adds Run key to start application
                                                                                                                                                                            PID:2664
                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                          4⤵
                                                                                                                                                                            PID:2680
                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                              REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                              5⤵
                                                                                                                                                                                PID:2708
                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                              4⤵
                                                                                                                                                                                PID:2724
                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                  REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                                  5⤵
                                                                                                                                                                                    PID:2752
                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                                  4⤵
                                                                                                                                                                                    PID:2768
                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                      REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                                      5⤵
                                                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                                                      PID:2796
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                                    4⤵
                                                                                                                                                                                      PID:2812
                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                        REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                                        5⤵
                                                                                                                                                                                        • Adds Run key to start application
                                                                                                                                                                                        PID:2840
                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                                      4⤵
                                                                                                                                                                                        PID:2856
                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                          REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                                          5⤵
                                                                                                                                                                                            PID:2884
                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                                          4⤵
                                                                                                                                                                                            PID:2900
                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                              REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                                              5⤵
                                                                                                                                                                                                PID:2928
                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                                              4⤵
                                                                                                                                                                                                PID:2944
                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                  REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                                                                  PID:2972
                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                                                4⤵
                                                                                                                                                                                                  PID:2988
                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                    REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                                                    PID:3016
                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                    PID:3032
                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                      REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                                                                      PID:3060
                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                      PID:1680
                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                        REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                          PID:2076
                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                          PID:2084
                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                            REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                            • Adds Run key to start application
                                                                                                                                                                                                            PID:2136
                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                            PID:2124
                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                              REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                PID:2168
                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                PID:1604
                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                  REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                    PID:2196
                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                    PID:2244
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                      REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                                                                                      PID:2256
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                      PID:268
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                        REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                        • Adds Run key to start application
                                                                                                                                                                                                                        PID:2292
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                        PID:2356
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                          REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                          • Adds Run key to start application
                                                                                                                                                                                                                          PID:2376
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                          PID:2396
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                            REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                              PID:2432

                                                                                                                                                                                                                    Network

                                                                                                                                                                                                                    MITRE ATT&CK Enterprise v6

                                                                                                                                                                                                                    Replay Monitor

                                                                                                                                                                                                                    Loading Replay Monitor...

                                                                                                                                                                                                                    Downloads

                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\system\images.exe

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      d36537604871b3550a9c5c635c37a601

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      a5360105e7b4d5316c88e5403013dd395c1ab145

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      4f3145508f4292ca3bfb6d9d4284b50df0834743676e6b951e71b4248d0d1a72

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      8b0c31bae27b95ee726fb77a2e0c6b82e599f73ad93d0fcf8c853cca2daf285796d0175ea1d5e0cfb3a40d5b80958a6c1d821b10eb241cba95a7c909ffe04df9

                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\system\images.exe

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      d36537604871b3550a9c5c635c37a601

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      a5360105e7b4d5316c88e5403013dd395c1ab145

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      4f3145508f4292ca3bfb6d9d4284b50df0834743676e6b951e71b4248d0d1a72

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      8b0c31bae27b95ee726fb77a2e0c6b82e599f73ad93d0fcf8c853cca2daf285796d0175ea1d5e0cfb3a40d5b80958a6c1d821b10eb241cba95a7c909ffe04df9

                                                                                                                                                                                                                    • \Users\Admin\AppData\Roaming\system\images.exe

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      d36537604871b3550a9c5c635c37a601

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      a5360105e7b4d5316c88e5403013dd395c1ab145

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      4f3145508f4292ca3bfb6d9d4284b50df0834743676e6b951e71b4248d0d1a72

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      8b0c31bae27b95ee726fb77a2e0c6b82e599f73ad93d0fcf8c853cca2daf285796d0175ea1d5e0cfb3a40d5b80958a6c1d821b10eb241cba95a7c909ffe04df9

                                                                                                                                                                                                                    • memory/108-80-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/108-107-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/268-181-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/452-74-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/560-38-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/560-83-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/560-64-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/560-52-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/620-66-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/620-98-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/620-92-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/684-75-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/820-56-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/832-46-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/844-0-0x0000000074450000-0x0000000074B3E000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      6.9MB

                                                                                                                                                                                                                    • memory/844-4-0x0000000000500000-0x000000000051F000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      124KB

                                                                                                                                                                                                                    • memory/844-3-0x0000000000220000-0x0000000000237000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      92KB

                                                                                                                                                                                                                    • memory/844-1-0x00000000008A0000-0x00000000008A1000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                    • memory/864-100-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/864-105-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/884-67-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/908-87-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/912-27-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/912-85-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/916-118-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/936-63-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/940-119-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/940-72-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/944-30-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/960-39-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/968-34-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/1004-43-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/1032-113-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/1084-54-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/1084-124-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/1112-48-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/1112-61-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/1124-55-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/1132-84-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/1220-33-0x0000000074450000-0x0000000074B3E000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      6.9MB

                                                                                                                                                                                                                    • memory/1220-32-0x0000000000400000-0x0000000000454000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      336KB

                                                                                                                                                                                                                    • memory/1220-31-0x0000000000400000-0x0000000000454000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      336KB

                                                                                                                                                                                                                    • memory/1220-28-0x0000000000400000-0x0000000000454000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      336KB

                                                                                                                                                                                                                    • memory/1220-29-0x000000000044C90E-mapping.dmp

                                                                                                                                                                                                                    • memory/1224-122-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/1236-45-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/1268-10-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/1268-15-0x0000000074450000-0x0000000074B3E000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      6.9MB

                                                                                                                                                                                                                    • memory/1268-23-0x0000000000A70000-0x0000000000A7A000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      40KB

                                                                                                                                                                                                                    • memory/1268-17-0x0000000000EF0000-0x0000000000EF1000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                    • memory/1272-57-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/1324-69-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/1396-49-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/1404-121-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/1404-94-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/1404-22-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/1404-110-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/1420-104-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/1420-44-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/1420-108-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/1420-86-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/1428-59-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/1436-21-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/1448-6-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/1452-102-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/1460-103-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/1460-40-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/1504-90-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/1520-96-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/1576-79-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/1576-70-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/1584-109-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/1588-106-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/1588-82-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/1588-117-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/1596-51-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/1604-177-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/1612-115-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/1612-112-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/1624-24-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/1628-114-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/1644-78-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/1644-58-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/1668-7-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/1676-89-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/1680-171-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/1688-62-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/1688-81-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/1692-65-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/1704-53-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/1724-41-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/1732-71-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/1740-77-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/1784-73-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/1816-91-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/1860-50-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/1860-111-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/1864-26-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/1892-93-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/1900-25-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/1908-47-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/1928-42-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/1944-68-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/1956-60-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/1968-116-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/1968-120-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/1968-123-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/1972-97-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/1980-76-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/1980-99-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/1984-88-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/1984-95-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/2004-101-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/2012-37-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/2060-125-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/2076-172-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/2084-173-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/2088-126-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/2104-127-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/2124-175-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/2132-128-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/2136-174-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/2148-129-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/2168-176-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/2176-130-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/2192-131-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/2196-178-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/2220-132-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/2236-133-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/2244-179-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/2256-180-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/2264-134-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/2280-135-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/2292-182-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/2308-136-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/2324-137-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/2352-138-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/2356-183-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/2368-139-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/2376-184-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/2396-140-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/2396-185-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/2416-141-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/2432-186-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/2444-142-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/2460-143-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/2488-144-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/2504-145-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/2532-146-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/2548-147-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/2576-148-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/2592-149-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/2620-150-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/2636-151-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/2664-152-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/2680-153-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/2708-154-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/2724-155-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/2752-156-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/2768-157-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/2796-158-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/2812-159-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/2840-160-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/2856-161-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/2884-162-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/2900-163-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/2928-164-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/2944-165-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/2972-166-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/2988-167-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/3016-168-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/3032-169-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                    • memory/3060-170-0x0000000000000000-mapping.dmp