Resubmissions

07-07-2022 07:38

220707-jgwxasfbgj 10

06-11-2020 17:38

201106-dv6jg3j51e 8

Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    06-11-2020 17:38

General

  • Target

    Booking Confirmation 110492024951 - copy - PDF.exe

  • Size

    783KB

  • MD5

    f867516ec5e600fb4af968c71b9a2a80

  • SHA1

    701970eb6a98cbc8661562155796f0491cf36efe

  • SHA256

    84e2088ea38d600fd562925b840117483cf4683573e92106c23c19bdfae2f878

  • SHA512

    d694a4898a7bca9aa1f9bfa20ca38c2768a608afc80b8dfa9a7bbbdc0740f7bab7514813530cec3ea66ce2b89cb916fcbbc94214d4859b8c98742e08ef486c41

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 156 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 652 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Booking Confirmation 110492024951 - copy - PDF.exe
    "C:\Users\Admin\AppData\Local\Temp\Booking Confirmation 110492024951 - copy - PDF.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2036
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\Booking Confirmation 110492024951 - copy - PDF.exe" "C:\Users\Admin\AppData\Roaming\system\images.exe"
      2⤵
        PID:1120
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c, "C:\Users\Admin\AppData\Roaming\system\images.exe"
        2⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:672
        • C:\Users\Admin\AppData\Roaming\system\images.exe
          "C:\Users\Admin\AppData\Roaming\system\images.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1808
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:1584
            • C:\Windows\SysWOW64\reg.exe
              REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
              5⤵
              • Adds Run key to start application
              PID:1508
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:1972
            • C:\Windows\SysWOW64\reg.exe
              REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
              5⤵
                PID:1688
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
              4⤵
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:1720
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:1744
              • C:\Windows\SysWOW64\reg.exe
                REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                5⤵
                  PID:1532
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                4⤵
                • Suspicious use of WriteProcessMemory
                PID:944
                • C:\Windows\SysWOW64\reg.exe
                  REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                  5⤵
                    PID:280
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                  4⤵
                    PID:1980
                    • C:\Windows\SysWOW64\reg.exe
                      REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                      5⤵
                      • Adds Run key to start application
                      PID:1912
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                    4⤵
                      PID:1924
                      • C:\Windows\SysWOW64\reg.exe
                        REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                        5⤵
                          PID:1416
                      • C:\Windows\SysWOW64\cmd.exe
                        "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                        4⤵
                          PID:1524
                          • C:\Windows\SysWOW64\reg.exe
                            REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                            5⤵
                            • Adds Run key to start application
                            PID:1832
                        • C:\Windows\SysWOW64\cmd.exe
                          "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                          4⤵
                            PID:1312
                            • C:\Windows\SysWOW64\reg.exe
                              REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                              5⤵
                              • Adds Run key to start application
                              PID:1544
                          • C:\Windows\SysWOW64\cmd.exe
                            "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                            4⤵
                              PID:1564
                              • C:\Windows\SysWOW64\reg.exe
                                REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                5⤵
                                • Adds Run key to start application
                                PID:1964
                            • C:\Windows\SysWOW64\cmd.exe
                              "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                              4⤵
                                PID:1364
                                • C:\Windows\SysWOW64\reg.exe
                                  REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                  5⤵
                                    PID:1644
                                • C:\Windows\SysWOW64\cmd.exe
                                  "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                  4⤵
                                    PID:968
                                    • C:\Windows\SysWOW64\reg.exe
                                      REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                      5⤵
                                      • Adds Run key to start application
                                      PID:272
                                  • C:\Windows\SysWOW64\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                    4⤵
                                      PID:1540
                                      • C:\Windows\SysWOW64\reg.exe
                                        REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                        5⤵
                                        • Adds Run key to start application
                                        PID:1892
                                    • C:\Windows\SysWOW64\cmd.exe
                                      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                      4⤵
                                        PID:760
                                        • C:\Windows\SysWOW64\reg.exe
                                          REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                          5⤵
                                          • Adds Run key to start application
                                          PID:2028
                                      • C:\Windows\SysWOW64\cmd.exe
                                        "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                        4⤵
                                          PID:1308
                                          • C:\Windows\SysWOW64\reg.exe
                                            REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                            5⤵
                                              PID:1824
                                          • C:\Windows\SysWOW64\cmd.exe
                                            "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                            4⤵
                                              PID:1544
                                              • C:\Windows\SysWOW64\reg.exe
                                                REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                5⤵
                                                • Adds Run key to start application
                                                PID:844
                                            • C:\Windows\SysWOW64\cmd.exe
                                              "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                              4⤵
                                                PID:1796
                                                • C:\Windows\SysWOW64\reg.exe
                                                  REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                  5⤵
                                                  • Adds Run key to start application
                                                  PID:564
                                              • C:\Windows\SysWOW64\cmd.exe
                                                "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                4⤵
                                                  PID:876
                                                  • C:\Windows\SysWOW64\reg.exe
                                                    REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                    5⤵
                                                      PID:532
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                    4⤵
                                                      PID:772
                                                      • C:\Windows\SysWOW64\reg.exe
                                                        REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                        5⤵
                                                        • Adds Run key to start application
                                                        PID:1892
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                      4⤵
                                                        PID:2036
                                                        • C:\Windows\SysWOW64\reg.exe
                                                          REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                          5⤵
                                                            PID:1404
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                          4⤵
                                                            PID:1832
                                                            • C:\Windows\SysWOW64\reg.exe
                                                              REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                              5⤵
                                                              • Adds Run key to start application
                                                              PID:900
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                            4⤵
                                                              PID:1964
                                                              • C:\Windows\SysWOW64\reg.exe
                                                                REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                5⤵
                                                                  PID:1688
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                4⤵
                                                                  PID:564
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                    5⤵
                                                                      PID:272
                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                    "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                    4⤵
                                                                      PID:872
                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                        REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                        5⤵
                                                                          PID:1892
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                        4⤵
                                                                          PID:2012
                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                            REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                            5⤵
                                                                              PID:1360
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                            4⤵
                                                                              PID:1824
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                5⤵
                                                                                • Adds Run key to start application
                                                                                PID:788
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                              4⤵
                                                                                PID:576
                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                  REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                  5⤵
                                                                                  • Adds Run key to start application
                                                                                  PID:1532
                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                4⤵
                                                                                  PID:972
                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                    REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                    5⤵
                                                                                    • Adds Run key to start application
                                                                                    PID:2008
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                  4⤵
                                                                                    PID:1912
                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                      REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                      5⤵
                                                                                        PID:952
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                      4⤵
                                                                                        PID:528
                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                          REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                          5⤵
                                                                                          • Adds Run key to start application
                                                                                          PID:1552
                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                        "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                        4⤵
                                                                                          PID:816
                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                            REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                            5⤵
                                                                                            • Adds Run key to start application
                                                                                            PID:1772
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                          4⤵
                                                                                            PID:1904
                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                              REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                              5⤵
                                                                                                PID:1260
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                              4⤵
                                                                                                PID:952
                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                  REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                  5⤵
                                                                                                    PID:1248
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                  4⤵
                                                                                                    PID:1232
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                      5⤵
                                                                                                      • Adds Run key to start application
                                                                                                      PID:960
                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                    "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                    4⤵
                                                                                                      PID:1632
                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                        REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                        5⤵
                                                                                                        • Adds Run key to start application
                                                                                                        PID:1260
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                      4⤵
                                                                                                        PID:1624
                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                          REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                          5⤵
                                                                                                          • Adds Run key to start application
                                                                                                          PID:1368
                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                        "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                        4⤵
                                                                                                          PID:1072
                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                            REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                            5⤵
                                                                                                            • Adds Run key to start application
                                                                                                            PID:328
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                          4⤵
                                                                                                            PID:1144
                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                              REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                              5⤵
                                                                                                                PID:2028
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                              4⤵
                                                                                                                PID:1432
                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                  REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                  5⤵
                                                                                                                    PID:532
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                  4⤵
                                                                                                                    PID:1404
                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                      REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                      5⤵
                                                                                                                        PID:1248
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                      4⤵
                                                                                                                        PID:1836
                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                          REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                          5⤵
                                                                                                                          • Adds Run key to start application
                                                                                                                          PID:1360
                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                        "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                        4⤵
                                                                                                                          PID:1248
                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                            REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                            5⤵
                                                                                                                            • Adds Run key to start application
                                                                                                                            PID:1288
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                          4⤵
                                                                                                                            PID:1620
                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                              REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                              5⤵
                                                                                                                              • Adds Run key to start application
                                                                                                                              PID:1532
                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                            "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                            4⤵
                                                                                                                              PID:1596
                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                5⤵
                                                                                                                                • Adds Run key to start application
                                                                                                                                PID:960
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                              4⤵
                                                                                                                                PID:1892
                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                  REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                  5⤵
                                                                                                                                  • Adds Run key to start application
                                                                                                                                  PID:1288
                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                4⤵
                                                                                                                                  PID:1368
                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                    REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                    5⤵
                                                                                                                                      PID:1288
                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                    "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                    4⤵
                                                                                                                                      PID:2060
                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                        REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                        5⤵
                                                                                                                                        • Adds Run key to start application
                                                                                                                                        PID:2088
                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                      4⤵
                                                                                                                                        PID:2104
                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                          REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                          5⤵
                                                                                                                                          • Adds Run key to start application
                                                                                                                                          PID:2132
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                        4⤵
                                                                                                                                          PID:2148
                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                            REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                            5⤵
                                                                                                                                            • Adds Run key to start application
                                                                                                                                            PID:2176
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                          4⤵
                                                                                                                                            PID:2192
                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                              REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                              5⤵
                                                                                                                                              • Adds Run key to start application
                                                                                                                                              PID:2220
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                            4⤵
                                                                                                                                              PID:2236
                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                5⤵
                                                                                                                                                  PID:2264
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                4⤵
                                                                                                                                                  PID:2280
                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                    REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                    5⤵
                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                    PID:2308
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                  4⤵
                                                                                                                                                    PID:2324
                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                      REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                      5⤵
                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                      PID:2352
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                    4⤵
                                                                                                                                                      PID:2368
                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                        REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                        5⤵
                                                                                                                                                        • Adds Run key to start application
                                                                                                                                                        PID:2396
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                      4⤵
                                                                                                                                                        PID:2412
                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                          REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                          5⤵
                                                                                                                                                          • Adds Run key to start application
                                                                                                                                                          PID:2440
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                        4⤵
                                                                                                                                                          PID:2456
                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                            REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                            5⤵
                                                                                                                                                            • Adds Run key to start application
                                                                                                                                                            PID:2484
                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                          "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                          4⤵
                                                                                                                                                            PID:2500
                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                              REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                              5⤵
                                                                                                                                                              • Adds Run key to start application
                                                                                                                                                              PID:2528
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                            4⤵
                                                                                                                                                              PID:2544
                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                5⤵
                                                                                                                                                                • Adds Run key to start application
                                                                                                                                                                PID:2572
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                              4⤵
                                                                                                                                                                PID:2588
                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                  REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                  5⤵
                                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                                  PID:2616
                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                4⤵
                                                                                                                                                                  PID:2632
                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                    REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                    5⤵
                                                                                                                                                                      PID:2660
                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                    4⤵
                                                                                                                                                                      PID:2676
                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                        REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                        5⤵
                                                                                                                                                                          PID:2704
                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                        4⤵
                                                                                                                                                                          PID:2720
                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                            REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                            5⤵
                                                                                                                                                                            • Adds Run key to start application
                                                                                                                                                                            PID:2748
                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                          4⤵
                                                                                                                                                                            PID:2764
                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                              REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                              5⤵
                                                                                                                                                                                PID:2792
                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                              4⤵
                                                                                                                                                                                PID:2808
                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                  REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                                  5⤵
                                                                                                                                                                                    PID:2836
                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                                  4⤵
                                                                                                                                                                                    PID:2852
                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                      REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                                      5⤵
                                                                                                                                                                                        PID:2880
                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                                      4⤵
                                                                                                                                                                                        PID:2896
                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                          REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                                          5⤵
                                                                                                                                                                                            PID:2924
                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                                          4⤵
                                                                                                                                                                                            PID:2940
                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                              REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                                              5⤵
                                                                                                                                                                                              • Adds Run key to start application
                                                                                                                                                                                              PID:2968
                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                                            4⤵
                                                                                                                                                                                              PID:2984
                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                                                5⤵
                                                                                                                                                                                                • Adds Run key to start application
                                                                                                                                                                                                PID:3012
                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                                              4⤵
                                                                                                                                                                                                PID:3028
                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                  REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                    PID:3056
                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                    PID:2052
                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                      REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                                                                      PID:676
                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                      PID:2092
                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                        REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                        • Adds Run key to start application
                                                                                                                                                                                                        PID:2120
                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                        PID:2128
                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                          REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                          • Adds Run key to start application
                                                                                                                                                                                                          PID:2180
                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                          PID:2168
                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                            REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                              PID:2196
                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                              PID:1736
                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                • Adds Run key to start application
                                                                                                                                                                                                                PID:2256
                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                PID:1848
                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                  REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                                                                                  PID:2284
                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                  PID:2340
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                    REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                                                                    PID:2336
                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                    PID:2400
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                      REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                                                                                      PID:2420
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                      PID:2444
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                        REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                          PID:2472
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                          PID:2480
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                            REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "images" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\images.exe"
                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                            • Adds Run key to start application
                                                                                                                                                                                                                            PID:2532

                                                                                                                                                                                                                  Network

                                                                                                                                                                                                                  MITRE ATT&CK Enterprise v6

                                                                                                                                                                                                                  Replay Monitor

                                                                                                                                                                                                                  Loading Replay Monitor...

                                                                                                                                                                                                                  Downloads

                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\system\images.exe

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    f867516ec5e600fb4af968c71b9a2a80

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    701970eb6a98cbc8661562155796f0491cf36efe

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    84e2088ea38d600fd562925b840117483cf4683573e92106c23c19bdfae2f878

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    d694a4898a7bca9aa1f9bfa20ca38c2768a608afc80b8dfa9a7bbbdc0740f7bab7514813530cec3ea66ce2b89cb916fcbbc94214d4859b8c98742e08ef486c41

                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\system\images.exe

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    f867516ec5e600fb4af968c71b9a2a80

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    701970eb6a98cbc8661562155796f0491cf36efe

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    84e2088ea38d600fd562925b840117483cf4683573e92106c23c19bdfae2f878

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    d694a4898a7bca9aa1f9bfa20ca38c2768a608afc80b8dfa9a7bbbdc0740f7bab7514813530cec3ea66ce2b89cb916fcbbc94214d4859b8c98742e08ef486c41

                                                                                                                                                                                                                  • \Users\Admin\AppData\Roaming\system\images.exe

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    f867516ec5e600fb4af968c71b9a2a80

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    701970eb6a98cbc8661562155796f0491cf36efe

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    84e2088ea38d600fd562925b840117483cf4683573e92106c23c19bdfae2f878

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    d694a4898a7bca9aa1f9bfa20ca38c2768a608afc80b8dfa9a7bbbdc0740f7bab7514813530cec3ea66ce2b89cb916fcbbc94214d4859b8c98742e08ef486c41

                                                                                                                                                                                                                  • memory/272-47-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/272-69-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/280-33-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/328-97-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/528-82-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/532-59-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/532-101-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/564-68-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/564-57-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/576-76-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/672-7-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/676-163-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/760-50-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/772-60-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/788-75-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/816-84-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/844-55-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/872-70-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/876-58-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/900-65-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/944-29-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/952-88-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/952-81-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/960-111-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/960-91-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/968-46-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/972-78-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/1072-96-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/1120-6-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/1144-98-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/1232-90-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/1248-106-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/1248-89-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/1248-103-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/1260-87-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/1260-93-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/1288-107-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/1288-113-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/1288-115-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/1308-52-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/1312-40-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/1360-105-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/1360-73-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/1364-44-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/1368-114-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/1368-95-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/1404-102-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/1404-63-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/1416-37-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/1432-100-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/1508-19-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/1524-38-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/1532-109-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/1532-24-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/1532-77-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/1540-48-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/1544-41-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/1544-54-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/1552-83-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/1564-42-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/1584-18-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/1596-110-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/1620-108-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/1624-94-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/1632-92-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/1644-45-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/1688-67-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/1688-22-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/1720-31-0x0000000000090000-0x0000000000092000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    8KB

                                                                                                                                                                                                                  • memory/1720-27-0x0000000000090000-0x00000000000E4000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    336KB

                                                                                                                                                                                                                  • memory/1720-26-0x000000000044C7BE-mapping.dmp

                                                                                                                                                                                                                  • memory/1720-30-0x0000000074E60000-0x000000007554E000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    6.9MB

                                                                                                                                                                                                                  • memory/1720-28-0x0000000000090000-0x00000000000E4000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    336KB

                                                                                                                                                                                                                  • memory/1736-170-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/1744-23-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/1772-85-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/1796-56-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/1808-12-0x0000000074E60000-0x000000007554E000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    6.9MB

                                                                                                                                                                                                                  • memory/1808-20-0x00000000007C0000-0x00000000007CA000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    40KB

                                                                                                                                                                                                                  • memory/1808-10-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/1808-13-0x00000000008F0000-0x00000000008F1000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                  • memory/1824-74-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/1824-53-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/1832-64-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/1832-39-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/1836-104-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/1848-172-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/1892-49-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/1892-112-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/1892-71-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/1892-61-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/1904-86-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/1912-80-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/1912-35-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/1924-36-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/1964-43-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/1964-66-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/1972-21-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/1980-34-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/2008-79-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/2012-72-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/2028-51-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/2028-99-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/2036-0-0x0000000074EE0000-0x00000000755CE000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    6.9MB

                                                                                                                                                                                                                  • memory/2036-62-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/2036-5-0x0000000000430000-0x0000000000436000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    24KB

                                                                                                                                                                                                                  • memory/2036-1-0x00000000010E0000-0x00000000010E1000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                  • memory/2036-3-0x0000000000310000-0x0000000000327000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    92KB

                                                                                                                                                                                                                  • memory/2036-4-0x0000000000380000-0x000000000039F000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    124KB

                                                                                                                                                                                                                  • memory/2052-162-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/2060-116-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/2088-117-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/2092-164-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/2104-118-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/2120-165-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/2128-166-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/2132-119-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/2148-120-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/2168-168-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/2176-121-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/2180-167-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/2192-122-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/2196-169-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/2220-123-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/2236-124-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/2256-171-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/2264-125-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/2280-126-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/2284-173-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/2308-127-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/2324-128-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/2336-175-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/2340-174-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/2352-129-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/2368-130-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/2396-131-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/2400-176-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/2412-132-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/2420-177-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/2440-133-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/2444-178-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/2456-134-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/2472-179-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/2480-180-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/2484-135-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/2500-136-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/2528-137-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/2532-181-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/2544-138-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/2572-139-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/2588-140-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/2616-141-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/2632-142-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/2660-143-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/2676-144-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/2704-145-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/2720-146-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/2748-147-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/2764-148-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/2792-149-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/2808-150-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/2836-151-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/2852-152-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/2880-153-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/2896-154-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/2924-155-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/2940-156-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/2968-157-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/2984-158-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/3012-159-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/3028-160-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                  • memory/3056-161-0x0000000000000000-mapping.dmp