Resubmissions

07-07-2022 07:38

220707-jgnwpafbfn 10

02-11-2020 14:43

201102-qmzdv5yy92 8

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    02-11-2020 14:43

General

  • Target

    Booking Confirmation591773251.exe

  • Size

    926KB

  • MD5

    d36537604871b3550a9c5c635c37a601

  • SHA1

    a5360105e7b4d5316c88e5403013dd395c1ab145

  • SHA256

    4f3145508f4292ca3bfb6d9d4284b50df0834743676e6b951e71b4248d0d1a72

  • SHA512

    8b0c31bae27b95ee726fb77a2e0c6b82e599f73ad93d0fcf8c853cca2daf285796d0175ea1d5e0cfb3a40d5b80958a6c1d821b10eb241cba95a7c909ffe04df9

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 190 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 588 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Booking Confirmation591773251.exe
    "C:\Users\Admin\AppData\Local\Temp\Booking Confirmation591773251.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1304
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\Booking Confirmation591773251.exe" "C:\Users\Admin\AppData\Roaming\system\images.exe"
      2⤵
        PID:1044
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c, "C:\Users\Admin\AppData\Roaming\system\images.exe"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:564
        • C:\Users\Admin\AppData\Roaming\system\images.exe
          "C:\Users\Admin\AppData\Roaming\system\images.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3944
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:2164
            • C:\Windows\SysWOW64\reg.exe
              REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
              5⤵
              • Adds Run key to start application
              PID:3672
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
            4⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2072
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:2184
            • C:\Windows\SysWOW64\reg.exe
              REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
              5⤵
              • Adds Run key to start application
              PID:2648
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:1836
            • C:\Windows\SysWOW64\reg.exe
              REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
              5⤵
                PID:988
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:2084
              • C:\Windows\SysWOW64\reg.exe
                REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                5⤵
                • Adds Run key to start application
                PID:692
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:3040
              • C:\Windows\SysWOW64\reg.exe
                REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                5⤵
                • Adds Run key to start application
                PID:1368
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:3828
              • C:\Windows\SysWOW64\reg.exe
                REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                5⤵
                • Adds Run key to start application
                PID:1444
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:2944
              • C:\Windows\SysWOW64\reg.exe
                REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                5⤵
                  PID:792
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                4⤵
                • Suspicious use of WriteProcessMemory
                PID:3680
                • C:\Windows\SysWOW64\reg.exe
                  REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                  5⤵
                  • Adds Run key to start application
                  PID:3668
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                4⤵
                  PID:1704
                  • C:\Windows\SysWOW64\reg.exe
                    REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                    5⤵
                      PID:812
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                    4⤵
                      PID:796
                      • C:\Windows\SysWOW64\reg.exe
                        REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                        5⤵
                        • Adds Run key to start application
                        PID:1308
                    • C:\Windows\SysWOW64\cmd.exe
                      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                      4⤵
                        PID:2552
                        • C:\Windows\SysWOW64\reg.exe
                          REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                          5⤵
                          • Adds Run key to start application
                          PID:3424
                      • C:\Windows\SysWOW64\cmd.exe
                        "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                        4⤵
                          PID:2096
                          • C:\Windows\SysWOW64\reg.exe
                            REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                            5⤵
                            • Adds Run key to start application
                            PID:416
                        • C:\Windows\SysWOW64\cmd.exe
                          "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                          4⤵
                            PID:372
                            • C:\Windows\SysWOW64\reg.exe
                              REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                              5⤵
                                PID:1728
                            • C:\Windows\SysWOW64\cmd.exe
                              "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                              4⤵
                                PID:808
                                • C:\Windows\SysWOW64\reg.exe
                                  REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                  5⤵
                                  • Adds Run key to start application
                                  PID:3396
                              • C:\Windows\SysWOW64\cmd.exe
                                "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                4⤵
                                  PID:1620
                                  • C:\Windows\SysWOW64\reg.exe
                                    REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                    5⤵
                                    • Adds Run key to start application
                                    PID:3784
                                • C:\Windows\SysWOW64\cmd.exe
                                  "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                  4⤵
                                    PID:2328
                                    • C:\Windows\SysWOW64\reg.exe
                                      REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                      5⤵
                                      • Adds Run key to start application
                                      PID:1716
                                  • C:\Windows\SysWOW64\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                    4⤵
                                      PID:1420
                                      • C:\Windows\SysWOW64\reg.exe
                                        REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                        5⤵
                                          PID:2796
                                      • C:\Windows\SysWOW64\cmd.exe
                                        "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                        4⤵
                                          PID:2520
                                          • C:\Windows\SysWOW64\reg.exe
                                            REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                            5⤵
                                            • Adds Run key to start application
                                            PID:4040
                                        • C:\Windows\SysWOW64\cmd.exe
                                          "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                          4⤵
                                            PID:2144
                                            • C:\Windows\SysWOW64\reg.exe
                                              REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                              5⤵
                                              • Adds Run key to start application
                                              PID:3488
                                          • C:\Windows\SysWOW64\cmd.exe
                                            "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                            4⤵
                                              PID:976
                                              • C:\Windows\SysWOW64\reg.exe
                                                REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                5⤵
                                                  PID:1320
                                              • C:\Windows\SysWOW64\cmd.exe
                                                "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                4⤵
                                                  PID:2500
                                                  • C:\Windows\SysWOW64\reg.exe
                                                    REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                    5⤵
                                                    • Adds Run key to start application
                                                    PID:2292
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                  4⤵
                                                    PID:2564
                                                    • C:\Windows\SysWOW64\reg.exe
                                                      REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                      5⤵
                                                      • Adds Run key to start application
                                                      PID:2276
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                    4⤵
                                                      PID:728
                                                      • C:\Windows\SysWOW64\reg.exe
                                                        REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                        5⤵
                                                          PID:3692
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                        4⤵
                                                          PID:2136
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                            5⤵
                                                              PID:968
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                            4⤵
                                                              PID:1048
                                                              • C:\Windows\SysWOW64\reg.exe
                                                                REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                5⤵
                                                                • Adds Run key to start application
                                                                PID:1520
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                              4⤵
                                                                PID:1572
                                                                • C:\Windows\SysWOW64\reg.exe
                                                                  REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                  5⤵
                                                                  • Adds Run key to start application
                                                                  PID:3928
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                4⤵
                                                                  PID:3656
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                    5⤵
                                                                    • Adds Run key to start application
                                                                    PID:552
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                  4⤵
                                                                    PID:980
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                      5⤵
                                                                      • Adds Run key to start application
                                                                      PID:3600
                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                    "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                    4⤵
                                                                      PID:1392
                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                        REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                        5⤵
                                                                        • Adds Run key to start application
                                                                        PID:1268
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                      4⤵
                                                                        PID:1640
                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                          REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                          5⤵
                                                                          • Adds Run key to start application
                                                                          PID:3140
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                        4⤵
                                                                          PID:1120
                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                            REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                            5⤵
                                                                              PID:1056
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                            4⤵
                                                                              PID:1424
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                5⤵
                                                                                  PID:1784
                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                4⤵
                                                                                  PID:560
                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                    REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                    5⤵
                                                                                      PID:3956
                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                    "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                    4⤵
                                                                                      PID:2732
                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                        REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                        5⤵
                                                                                          PID:2880
                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                        "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                        4⤵
                                                                                          PID:2524
                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                            REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                            5⤵
                                                                                              PID:2800
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                            4⤵
                                                                                              PID:1844
                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                5⤵
                                                                                                • Adds Run key to start application
                                                                                                PID:1128
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                              4⤵
                                                                                                PID:1796
                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                  REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                  5⤵
                                                                                                  • Adds Run key to start application
                                                                                                  PID:2464
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                4⤵
                                                                                                  PID:188
                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                    REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                    5⤵
                                                                                                    • Adds Run key to start application
                                                                                                    PID:2280
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                  4⤵
                                                                                                    PID:4120
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                      5⤵
                                                                                                      • Adds Run key to start application
                                                                                                      PID:4164
                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                    "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                    4⤵
                                                                                                      PID:4188
                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                        REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                        5⤵
                                                                                                          PID:4232
                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                        "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                        4⤵
                                                                                                          PID:4256
                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                            REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                            5⤵
                                                                                                            • Adds Run key to start application
                                                                                                            PID:4300
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                          4⤵
                                                                                                            PID:4324
                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                              REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                              5⤵
                                                                                                                PID:4368
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                              4⤵
                                                                                                                PID:4392
                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                  REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                  5⤵
                                                                                                                    PID:4436
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                  4⤵
                                                                                                                    PID:4460
                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                      REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                      5⤵
                                                                                                                      • Adds Run key to start application
                                                                                                                      PID:4504
                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                    "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                    4⤵
                                                                                                                      PID:4528
                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                        REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                        5⤵
                                                                                                                        • Adds Run key to start application
                                                                                                                        PID:4572
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                      4⤵
                                                                                                                        PID:4596
                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                          REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                          5⤵
                                                                                                                          • Adds Run key to start application
                                                                                                                          PID:4640
                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                        "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                        4⤵
                                                                                                                          PID:4664
                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                            REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                            5⤵
                                                                                                                            • Adds Run key to start application
                                                                                                                            PID:4708
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                          4⤵
                                                                                                                            PID:4732
                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                              REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                              5⤵
                                                                                                                              • Adds Run key to start application
                                                                                                                              PID:4776
                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                            "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                            4⤵
                                                                                                                              PID:4800
                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                5⤵
                                                                                                                                  PID:4844
                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                4⤵
                                                                                                                                  PID:4868
                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                    REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                    5⤵
                                                                                                                                      PID:4912
                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                    "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                    4⤵
                                                                                                                                      PID:4936
                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                        REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                        5⤵
                                                                                                                                          PID:4980
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                        4⤵
                                                                                                                                          PID:5004
                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                            REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                            5⤵
                                                                                                                                              PID:5048
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                            4⤵
                                                                                                                                              PID:5072
                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                5⤵
                                                                                                                                                  PID:5116
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                4⤵
                                                                                                                                                  PID:2152
                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                    REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                    5⤵
                                                                                                                                                      PID:4180
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                    4⤵
                                                                                                                                                      PID:4144
                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                        REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                        5⤵
                                                                                                                                                        • Adds Run key to start application
                                                                                                                                                        PID:4216
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                      4⤵
                                                                                                                                                        PID:4200
                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                          REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                          5⤵
                                                                                                                                                          • Adds Run key to start application
                                                                                                                                                          PID:4280
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                        4⤵
                                                                                                                                                          PID:4340
                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                            REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                            5⤵
                                                                                                                                                              PID:4344
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                            4⤵
                                                                                                                                                              PID:4448
                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                5⤵
                                                                                                                                                                • Adds Run key to start application
                                                                                                                                                                PID:4476
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                              4⤵
                                                                                                                                                                PID:4500
                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                  REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                  5⤵
                                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                                  PID:4584
                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                4⤵
                                                                                                                                                                  PID:4552
                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                    REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                    5⤵
                                                                                                                                                                      PID:4636
                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                    4⤵
                                                                                                                                                                      PID:4608
                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                        REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                        5⤵
                                                                                                                                                                        • Adds Run key to start application
                                                                                                                                                                        PID:4684
                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                      4⤵
                                                                                                                                                                        PID:4784
                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                          REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                          5⤵
                                                                                                                                                                          • Adds Run key to start application
                                                                                                                                                                          PID:4744
                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                        4⤵
                                                                                                                                                                          PID:4848
                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                            REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                            5⤵
                                                                                                                                                                            • Adds Run key to start application
                                                                                                                                                                            PID:4884
                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                          4⤵
                                                                                                                                                                            PID:4908
                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                              REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                              5⤵
                                                                                                                                                                                PID:4992
                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                              4⤵
                                                                                                                                                                                PID:4956
                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                  REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                                  5⤵
                                                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                                                  PID:5032
                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                                4⤵
                                                                                                                                                                                  PID:5024
                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                    REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                                    5⤵
                                                                                                                                                                                      PID:5076
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                                    4⤵
                                                                                                                                                                                      PID:2132
                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                        REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                                        5⤵
                                                                                                                                                                                          PID:1272
                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                                        4⤵
                                                                                                                                                                                          PID:4224
                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                            REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                                            5⤵
                                                                                                                                                                                            • Adds Run key to start application
                                                                                                                                                                                            PID:4304
                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                                          4⤵
                                                                                                                                                                                            PID:4260
                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                              REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                                              5⤵
                                                                                                                                                                                                PID:4408
                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                                              4⤵
                                                                                                                                                                                                PID:4364
                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                  REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                    PID:4428
                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                    PID:4432
                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                      REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                                                                      PID:4472
                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                      PID:4600
                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                        REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                          PID:4540
                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                          PID:4676
                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                            REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                            • Adds Run key to start application
                                                                                                                                                                                                            PID:4816
                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                            PID:4756
                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                              REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                              • Adds Run key to start application
                                                                                                                                                                                                              PID:4920
                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                              PID:4824
                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                  PID:4900
                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                  PID:2156
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                    REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                      PID:5012
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                      PID:5092
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                        REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                          PID:4176
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                          PID:4136
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                            REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                            • Adds Run key to start application
                                                                                                                                                                                                                            PID:2112
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                            PID:4240
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                              REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                              • Adds Run key to start application
                                                                                                                                                                                                                              PID:4444
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                              PID:4312
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                  PID:4508
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                  PID:4480
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                    REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                      PID:4556
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                      PID:4696
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                        REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                          PID:4852
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                          PID:4716
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                            REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                              PID:4876
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                              PID:4924
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                  PID:992
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                  PID:748
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                    REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                      PID:4888
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                      PID:4996
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                        REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                          PID:4972
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                          PID:5104
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                            REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                              PID:5088
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                              PID:4276
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                • Adds Run key to start application
                                                                                                                                                                                                                                                                PID:4156
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                PID:4328
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                  REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                    PID:4496
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                    PID:4352
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                      REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                                                                                                                                      PID:4464
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                      PID:4588
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                        REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                          PID:4628
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                          PID:4712
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                            REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                            • Adds Run key to start application
                                                                                                                                                                                                                                                                            PID:4704
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                            PID:4080
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                              REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                PID:2076
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                PID:4892
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                  REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                                                                                                                                                  PID:5020
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                  PID:5108
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                    REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                                                                                                                                    PID:4108

                                                                                                                                                                                                                                                                          Network

                                                                                                                                                                                                                                                                          MITRE ATT&CK Enterprise v6

                                                                                                                                                                                                                                                                          Replay Monitor

                                                                                                                                                                                                                                                                          Loading Replay Monitor...

                                                                                                                                                                                                                                                                          Downloads

                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\system\images.exe

                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                            d36537604871b3550a9c5c635c37a601

                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                            a5360105e7b4d5316c88e5403013dd395c1ab145

                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                            4f3145508f4292ca3bfb6d9d4284b50df0834743676e6b951e71b4248d0d1a72

                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                            8b0c31bae27b95ee726fb77a2e0c6b82e599f73ad93d0fcf8c853cca2daf285796d0175ea1d5e0cfb3a40d5b80958a6c1d821b10eb241cba95a7c909ffe04df9

                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\system\images.exe

                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                            d36537604871b3550a9c5c635c37a601

                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                            a5360105e7b4d5316c88e5403013dd395c1ab145

                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                            4f3145508f4292ca3bfb6d9d4284b50df0834743676e6b951e71b4248d0d1a72

                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                            8b0c31bae27b95ee726fb77a2e0c6b82e599f73ad93d0fcf8c853cca2daf285796d0175ea1d5e0cfb3a40d5b80958a6c1d821b10eb241cba95a7c909ffe04df9

                                                                                                                                                                                                                                                                          • memory/188-109-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/372-59-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/416-58-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/552-88-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/560-99-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/564-9-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/692-37-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/728-79-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/748-203-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/792-46-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/796-53-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/808-61-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/812-52-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/968-82-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/976-73-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/980-89-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/988-28-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/992-202-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/1044-8-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/1048-83-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/1056-96-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/1120-95-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/1128-106-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/1268-92-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/1272-168-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/1304-7-0x0000000007FA0000-0x0000000007FA1000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                          • memory/1304-6-0x00000000083A0000-0x00000000083A1000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                          • memory/1304-5-0x0000000007BE0000-0x0000000007BFF000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            124KB

                                                                                                                                                                                                                                                                          • memory/1304-1-0x0000000000D80000-0x0000000000D81000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                          • memory/1304-0-0x0000000073C50000-0x000000007433E000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            6.9MB

                                                                                                                                                                                                                                                                          • memory/1304-4-0x00000000055B0000-0x00000000055C7000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            92KB

                                                                                                                                                                                                                                                                          • memory/1304-3-0x00000000056A0000-0x00000000056A1000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                          • memory/1308-54-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/1320-74-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/1368-42-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/1392-91-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/1420-67-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/1424-97-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/1444-44-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/1520-84-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/1572-85-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/1620-63-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/1640-93-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/1704-51-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/1716-66-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/1728-60-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/1784-98-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/1796-107-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/1836-27-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/1844-105-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/2072-47-0x0000000007320000-0x0000000007321000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                          • memory/2072-29-0x0000000000400000-0x0000000000454000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            336KB

                                                                                                                                                                                                                                                                          • memory/2072-39-0x0000000005060000-0x0000000005061000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                          • memory/2072-32-0x0000000073C50000-0x000000007433E000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            6.9MB

                                                                                                                                                                                                                                                                          • memory/2072-50-0x0000000008FD0000-0x0000000008FD1000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                          • memory/2072-31-0x0000000000400000-0x0000000000454000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            336KB

                                                                                                                                                                                                                                                                          • memory/2072-30-0x000000000044C90E-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/2076-220-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/2084-34-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/2096-57-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/2112-190-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/2132-167-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/2136-81-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/2144-71-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/2152-141-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/2156-185-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/2164-21-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/2184-24-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/2276-78-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/2280-110-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/2292-76-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/2328-65-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/2464-108-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/2500-75-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/2520-69-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/2524-103-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/2552-55-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/2564-77-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/2648-26-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/2732-101-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/2796-68-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/2800-104-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/2880-102-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/2944-45-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/3040-41-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/3140-94-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/3396-62-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/3424-56-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/3488-72-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/3600-90-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/3656-87-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/3668-49-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/3672-22-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/3680-48-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/3692-80-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/3784-64-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/3828-43-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/3928-86-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/3944-13-0x0000000073C50000-0x000000007433E000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            6.9MB

                                                                                                                                                                                                                                                                          • memory/3944-23-0x0000000009720000-0x000000000972A000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            40KB

                                                                                                                                                                                                                                                                          • memory/3944-25-0x00000000098A0000-0x00000000098A1000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                          • memory/3944-10-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/3956-100-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/4040-70-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/4080-219-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/4108-224-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/4120-111-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/4136-189-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/4144-143-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/4156-210-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/4164-112-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/4176-188-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/4180-142-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/4188-113-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/4200-145-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/4216-144-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/4224-169-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/4232-114-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/4240-191-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/4256-115-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/4260-171-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/4276-209-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/4280-146-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/4300-116-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/4304-170-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/4312-193-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/4324-117-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/4328-211-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/4340-147-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/4344-148-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/4352-213-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/4364-173-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/4368-118-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/4392-119-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/4408-172-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/4428-174-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/4432-175-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/4436-120-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/4444-192-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/4448-149-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/4460-121-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/4464-214-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/4472-176-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/4476-150-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/4480-195-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/4496-212-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/4500-151-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/4504-122-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/4508-194-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/4528-123-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/4540-178-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/4552-153-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/4556-196-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/4572-124-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/4584-152-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/4588-215-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/4596-125-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/4600-177-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/4608-155-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/4628-216-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/4636-154-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/4640-126-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/4664-127-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/4676-179-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/4684-156-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/4696-197-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/4704-218-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/4708-128-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/4712-217-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/4716-199-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/4732-129-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/4744-158-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/4756-181-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/4776-130-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/4784-157-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/4800-131-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/4816-180-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/4824-183-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/4844-132-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/4848-159-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/4852-198-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/4868-133-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/4876-200-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/4884-160-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/4888-204-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/4892-221-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/4900-184-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/4908-161-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/4912-134-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/4920-182-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/4924-201-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/4936-135-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/4956-163-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/4972-206-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/4980-136-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/4992-162-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/4996-205-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/5004-137-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/5012-186-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/5020-222-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/5024-165-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/5032-164-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/5048-138-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/5072-139-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/5076-166-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/5088-208-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/5092-187-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/5104-207-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/5108-223-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                          • memory/5116-140-0x0000000000000000-mapping.dmp