Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
04-12-2020 18:27
Static task
static1
Behavioral task
behavioral1
Sample
PAYMENT COPY.exe
Resource
win7v20201028
General
-
Target
PAYMENT COPY.exe
-
Size
585KB
-
MD5
7f038b33a43afc2d9687337f963e8ab5
-
SHA1
bfde3d1da7ae9f63050bb48d71433f3e112ad87e
-
SHA256
8a1531470b71afbae59477a8ba23f4f0c72895700676fd3b5371a2e7f9637b86
-
SHA512
52afc34a279f83e5b91989d8ec07d3ac5f71c46ee13e344e8e4d9c73e565596ed91d9a539266a4230318b282146da5e11dc26649bf01809977ec66c5b7405810
Malware Config
Extracted
nanocore
1.2.2.0
e12345.ddns.net:9034
79.134.225.22:9034
b92fa5b2-56be-4ad1-a2f0-1fdcc67d7c0b
-
activate_away_mode
false
-
backup_connection_host
79.134.225.22
- backup_dns_server
-
buffer_size
65538
-
build_time
2020-09-03T11:34:59.807683136Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
false
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
9034
-
default_group
TODAY2020
-
enable_debug_mode
true
-
gc_threshold
1.0485772e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.0485772e+07
-
mutex
b92fa5b2-56be-4ad1-a2f0-1fdcc67d7c0b
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
e12345.ddns.net
- primary_dns_server
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
false
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8009
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
qcxza.exepid process 648 qcxza.exe -
Adds Run key to start application 2 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exeInstallUtil.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\qcxza = "C:\\Users\\Admin\\Pictures\\qcxza.exe" reg.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\qcxza = "C:\\Users\\Admin\\Pictures\\qcxza.exe" reg.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\qcxza = "C:\\Users\\Admin\\Pictures\\qcxza.exe" reg.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\qcxza = "C:\\Users\\Admin\\Pictures\\qcxza.exe" reg.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\qcxza = "C:\\Users\\Admin\\Pictures\\qcxza.exe" reg.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\qcxza = "C:\\Users\\Admin\\Pictures\\qcxza.exe" reg.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\qcxza = "C:\\Users\\Admin\\Pictures\\qcxza.exe" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\qcxza = "C:\\Users\\Admin\\Pictures\\qcxza.exe" reg.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\qcxza = "C:\\Users\\Admin\\Pictures\\qcxza.exe" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\qcxza = "C:\\Users\\Admin\\Pictures\\qcxza.exe" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\qcxza = "C:\\Users\\Admin\\Pictures\\qcxza.exe" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\qcxza = "C:\\Users\\Admin\\Pictures\\qcxza.exe" reg.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\qcxza = "C:\\Users\\Admin\\Pictures\\qcxza.exe" reg.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\qcxza = "C:\\Users\\Admin\\Pictures\\qcxza.exe" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\qcxza = "C:\\Users\\Admin\\Pictures\\qcxza.exe" reg.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\qcxza = "C:\\Users\\Admin\\Pictures\\qcxza.exe" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\qcxza = "C:\\Users\\Admin\\Pictures\\qcxza.exe" reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WAN Service = "C:\\Program Files (x86)\\WAN Service\\wansv.exe" InstallUtil.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\qcxza = "C:\\Users\\Admin\\Pictures\\qcxza.exe" reg.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\qcxza = "C:\\Users\\Admin\\Pictures\\qcxza.exe" reg.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\qcxza = "C:\\Users\\Admin\\Pictures\\qcxza.exe" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\qcxza = "C:\\Users\\Admin\\Pictures\\qcxza.exe" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\qcxza = "C:\\Users\\Admin\\Pictures\\qcxza.exe" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\qcxza = "C:\\Users\\Admin\\Pictures\\qcxza.exe" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\qcxza = "C:\\Users\\Admin\\Pictures\\qcxza.exe" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\qcxza = "C:\\Users\\Admin\\Pictures\\qcxza.exe" reg.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\qcxza = "C:\\Users\\Admin\\Pictures\\qcxza.exe" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\qcxza = "C:\\Users\\Admin\\Pictures\\qcxza.exe" reg.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\qcxza = "C:\\Users\\Admin\\Pictures\\qcxza.exe" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\qcxza = "C:\\Users\\Admin\\Pictures\\qcxza.exe" reg.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
qcxza.exedescription pid process target process PID 648 set thread context of 1740 648 qcxza.exe InstallUtil.exe -
Drops file in Program Files directory 2 IoCs
Processes:
InstallUtil.exedescription ioc process File created C:\Program Files (x86)\WAN Service\wansv.exe InstallUtil.exe File opened for modification C:\Program Files (x86)\WAN Service\wansv.exe InstallUtil.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 2180 schtasks.exe 1348 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
qcxza.exeInstallUtil.exepid process 648 qcxza.exe 648 qcxza.exe 1740 InstallUtil.exe 1740 InstallUtil.exe 1740 InstallUtil.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
Processes:
InstallUtil.exeqcxza.exepid process 1740 InstallUtil.exe 648 qcxza.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
PAYMENT COPY.exeqcxza.exeInstallUtil.exedescription pid process Token: SeDebugPrivilege 1112 PAYMENT COPY.exe Token: SeDebugPrivilege 648 qcxza.exe Token: SeDebugPrivilege 1740 InstallUtil.exe Token: SeDebugPrivilege 1740 InstallUtil.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
PAYMENT COPY.execmd.exeqcxza.execmd.execmd.execmd.execmd.execmd.exeInstallUtil.execmd.execmd.exedescription pid process target process PID 1112 wrote to memory of 400 1112 PAYMENT COPY.exe cmd.exe PID 1112 wrote to memory of 400 1112 PAYMENT COPY.exe cmd.exe PID 1112 wrote to memory of 400 1112 PAYMENT COPY.exe cmd.exe PID 1112 wrote to memory of 1156 1112 PAYMENT COPY.exe cmd.exe PID 1112 wrote to memory of 1156 1112 PAYMENT COPY.exe cmd.exe PID 1112 wrote to memory of 1156 1112 PAYMENT COPY.exe cmd.exe PID 1156 wrote to memory of 648 1156 cmd.exe qcxza.exe PID 1156 wrote to memory of 648 1156 cmd.exe qcxza.exe PID 1156 wrote to memory of 648 1156 cmd.exe qcxza.exe PID 648 wrote to memory of 3628 648 qcxza.exe cmd.exe PID 648 wrote to memory of 3628 648 qcxza.exe cmd.exe PID 648 wrote to memory of 3628 648 qcxza.exe cmd.exe PID 3628 wrote to memory of 640 3628 cmd.exe reg.exe PID 3628 wrote to memory of 640 3628 cmd.exe reg.exe PID 3628 wrote to memory of 640 3628 cmd.exe reg.exe PID 648 wrote to memory of 1168 648 qcxza.exe cmd.exe PID 648 wrote to memory of 1168 648 qcxza.exe cmd.exe PID 648 wrote to memory of 1168 648 qcxza.exe cmd.exe PID 648 wrote to memory of 1740 648 qcxza.exe InstallUtil.exe PID 648 wrote to memory of 1740 648 qcxza.exe InstallUtil.exe PID 648 wrote to memory of 1740 648 qcxza.exe InstallUtil.exe PID 1168 wrote to memory of 4056 1168 cmd.exe reg.exe PID 1168 wrote to memory of 4056 1168 cmd.exe reg.exe PID 1168 wrote to memory of 4056 1168 cmd.exe reg.exe PID 648 wrote to memory of 1740 648 qcxza.exe InstallUtil.exe PID 648 wrote to memory of 1740 648 qcxza.exe InstallUtil.exe PID 648 wrote to memory of 1740 648 qcxza.exe InstallUtil.exe PID 648 wrote to memory of 1740 648 qcxza.exe InstallUtil.exe PID 648 wrote to memory of 1740 648 qcxza.exe InstallUtil.exe PID 648 wrote to memory of 3244 648 qcxza.exe cmd.exe PID 648 wrote to memory of 3244 648 qcxza.exe cmd.exe PID 648 wrote to memory of 3244 648 qcxza.exe cmd.exe PID 3244 wrote to memory of 420 3244 cmd.exe reg.exe PID 3244 wrote to memory of 420 3244 cmd.exe reg.exe PID 3244 wrote to memory of 420 3244 cmd.exe reg.exe PID 648 wrote to memory of 2756 648 qcxza.exe cmd.exe PID 648 wrote to memory of 2756 648 qcxza.exe cmd.exe PID 648 wrote to memory of 2756 648 qcxza.exe cmd.exe PID 2756 wrote to memory of 1032 2756 cmd.exe reg.exe PID 2756 wrote to memory of 1032 2756 cmd.exe reg.exe PID 2756 wrote to memory of 1032 2756 cmd.exe reg.exe PID 648 wrote to memory of 2800 648 qcxza.exe cmd.exe PID 648 wrote to memory of 2800 648 qcxza.exe cmd.exe PID 648 wrote to memory of 2800 648 qcxza.exe cmd.exe PID 2800 wrote to memory of 3400 2800 cmd.exe reg.exe PID 2800 wrote to memory of 3400 2800 cmd.exe reg.exe PID 2800 wrote to memory of 3400 2800 cmd.exe reg.exe PID 1740 wrote to memory of 2180 1740 InstallUtil.exe schtasks.exe PID 1740 wrote to memory of 2180 1740 InstallUtil.exe schtasks.exe PID 1740 wrote to memory of 2180 1740 InstallUtil.exe schtasks.exe PID 1740 wrote to memory of 1348 1740 InstallUtil.exe schtasks.exe PID 1740 wrote to memory of 1348 1740 InstallUtil.exe schtasks.exe PID 1740 wrote to memory of 1348 1740 InstallUtil.exe schtasks.exe PID 648 wrote to memory of 2112 648 qcxza.exe cmd.exe PID 648 wrote to memory of 2112 648 qcxza.exe cmd.exe PID 648 wrote to memory of 2112 648 qcxza.exe cmd.exe PID 2112 wrote to memory of 804 2112 cmd.exe reg.exe PID 2112 wrote to memory of 804 2112 cmd.exe reg.exe PID 2112 wrote to memory of 804 2112 cmd.exe reg.exe PID 648 wrote to memory of 2760 648 qcxza.exe cmd.exe PID 648 wrote to memory of 2760 648 qcxza.exe cmd.exe PID 648 wrote to memory of 2760 648 qcxza.exe cmd.exe PID 2760 wrote to memory of 2772 2760 cmd.exe reg.exe PID 2760 wrote to memory of 2772 2760 cmd.exe reg.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PAYMENT COPY.exe"C:\Users\Admin\AppData\Local\Temp\PAYMENT COPY.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\PAYMENT COPY.exe" "C:\Users\Admin\Pictures\qcxza.exe"2⤵PID:400
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c, "C:\Users\Admin\Pictures\qcxza.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\Users\Admin\Pictures\qcxza.exe"C:\Users\Admin\Pictures\qcxza.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:648 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
- Suspicious use of WriteProcessMemory
PID:3628 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:640
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:4056
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"4⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "WAN Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmp67B8.tmp"5⤵
- Creates scheduled task(s)
PID:2180 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "WAN Service Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp6875.tmp"5⤵
- Creates scheduled task(s)
PID:1348 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
- Suspicious use of WriteProcessMemory
PID:3244 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:420
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
PID:1032 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:3400
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:804
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
PID:2772 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:3520
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:1248
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:612
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
PID:2688 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:500
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:2060
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:4068
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:3920
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:2872
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:3412
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:1212
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:200
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:2696
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:2256
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:4036
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:3220
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:508
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:3776
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:3408
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:2244
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:3672
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:3636
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:1676
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
PID:3192 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:852
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
PID:3892 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:3728
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:3232
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:3084
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:1424
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:3936
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:2160
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:2916
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:2228
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:1700
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:968
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:3288
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:3208
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:3660
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:2096
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:2604
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:3836
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:848
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
PID:1728 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:1872
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:1604
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:2076
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:1332
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:3900
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:3904
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:644
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:1316
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:3820
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:1028
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:4108
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:4152
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:4176
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:4220
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:4244
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
PID:4288 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:4312
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:4356
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:4380
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:4424
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:4448
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:4492
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:4516
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:4560
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:4584
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
PID:4628 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:4652
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:4696
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:4720
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:4764
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:4792
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
PID:4836 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:4864
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
PID:4908 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:4932
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:4976
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:5000
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:5044
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:5068
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:5112
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:2088
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:1512
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:4160
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:4120
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:4224
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
PID:4296 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:4276
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:4368
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:4332
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:4412
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:4456
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
PID:4484 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:4564
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:4592
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:4612
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:4700
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:4656
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
PID:4748 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:4740
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:4832
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:4804
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:4904
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:4876
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:4956
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:5052
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:5012
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:1892
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:1856
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:1556
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:4148
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:4112
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:4272
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:4212
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:4328
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:4256
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
PID:4428 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:4500
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
PID:4452 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:4640
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:4616
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:4596
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:4744
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:4736
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:4856
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:2212
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:4880
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:4952
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:4984
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:3540
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:1328
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:5104
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:4236
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:3344
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:4132
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:4200
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:4316
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:4432
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:4460
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:4488
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
PID:4680 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:4644
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:4752
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:4624
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
PID:4796 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:1732
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:4900
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:5028
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:4968
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:956
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:4164
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:4184
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:4156
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:4292
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:4352
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:4336
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:4404
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:4608
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:4504
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:4668
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:4824
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:4784
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:4868
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:2548
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
PID:4960 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:5108
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:5072
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:2204
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
PID:4168 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:4264
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
PID:4480 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:4556
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
PID:4468 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:4692
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
PID:4772 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:4844
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:4820
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:4964
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:5056
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:5024
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:4304
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:4192
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:1196
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:2320
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:2520
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:2600
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:4588
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:3812
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:4724
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:4912
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:4896
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:3216
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:5048
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:4252
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:1224
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:3944
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:4208
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:4400
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:4552
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:4540
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:1576
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:4872
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
PID:4848 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:5032
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:5036
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:2356
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:4408
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:4524
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:4028
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:4704
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:4816
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:4800
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:188
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:5084
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:1860
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:4364
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:4100
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:4464
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
PID:4572 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:4536
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:4992
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:2036
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:2100
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:4416
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:4136
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:4732
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
PID:5100 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:4884
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:4116
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:4948
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:1468
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:4144
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
PID:4672 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:904
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:4604
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:4300
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
PID:4988 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:4944
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:4676
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:2120
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
PID:2524 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:4180
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:936
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:4268
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:4260
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:5088
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
PID:4924 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:4600
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
PID:668 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:2876
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:5008
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:4728
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
PID:4840 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:3640
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
PID:4436 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:5144
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:5188
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:5212
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:5256
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:5280
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:5324
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:5348
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:5392
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:5416
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
PID:5460 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:5484
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
PID:5528 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:5552
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:5596
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:5620
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:5664
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:5688
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:5732
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:5756
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:5800
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:5824
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:5868
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:5892
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:5936
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:5960
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:6004
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:6028
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:6072
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:6096
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:6140
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:1044
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:5200
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:5168
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:5252
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:5224
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:5304
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:5400
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:5360
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:5464
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
PID:5536 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:5488
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:5600
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:5588
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
PID:5660 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:5632
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:5708
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:5808
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:5768
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:5864
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
PID:5952 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:5896
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:6000
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:5980
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
PID:6032 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:6112
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:6116
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:5184
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:5220
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:5240
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:5292
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:5328
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
PID:5380 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:5404
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
PID:5452 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:5592
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:5520
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:5652
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
PID:5720 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:5728
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
PID:5832 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:5792
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
PID:5900 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:5928
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:6016
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:6040
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:5124
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:6128
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:5244
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:2116
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:5296
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:5268
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
PID:5312 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:5512
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:5540
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:5624
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:5572
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:5736
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:5780
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:5812
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:5836
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:5856
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:6012
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:4760
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:6076
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:5236
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
PID:5340 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:5308
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:5432
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:5372
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:5456
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:5516
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:5580
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:5840
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
PID:5740 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:5920
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
PID:5984 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:6020
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
PID:6056 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:5172
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:6136
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:5352
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:5284
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:5532
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:5724
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:5608
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
PID:5944 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:1876
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:6052
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:5848
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:6124
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:5136
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
PID:5180 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:5880
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:5704
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:5556
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:5804
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:5796
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:5904
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:740
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:5164
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:5444
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:5424
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:5544
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:5368
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:5560
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:5976
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:5988
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:5972
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:5216
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
PID:5356 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:5564
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:4000
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:5908
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:6088
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:5204
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:5160
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:5132
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:5568
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:900
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:6008
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:5408
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:6068
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:5760
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:5428
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:5852
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:5964
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:5156
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:5968
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:6132
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:5476
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:5672
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
PID:5748 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:5396
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:5508
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:5844
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
PID:5676 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:5680
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:5496
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:5260
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:6048
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:6156
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:6200
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:6224
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:6268
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:6296
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:6340
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:6364
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:6408
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:6432
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:6476
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:6500
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:6544
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:6568
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:6612
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:6636
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:6680
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:6704
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:6748
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:6772
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
PID:6816 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:6840
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:6884
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:6908
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:6952
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:6976
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:7020
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:7044
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:7088
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:7112
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:7156
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:5248
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:6216
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:6160
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
PID:6284 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:6260
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:6328
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:6372
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
PID:6400 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:6492
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
PID:6508 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:6540
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
PID:6624 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵PID:6592
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵PID:6664
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp67B8.tmpMD5
576bbaf398045c3843d452ec83208236
SHA18ed5b2500ae7a40cbfa6e9018a1d1f1e70cb1374
SHA25633c0c2d72fa383e5988ce640febc5ac6a2bd71d4ae660b99e52234952e17467b
SHA512e7cc0ea0b351c6a8618e14f03c00e88ef83e2f169e0b4d66513f580f0a9352fbfe429e57186362b69407150d566bbdadca2f7b574fc748cc140b3249be67f96a
-
C:\Users\Admin\AppData\Local\Temp\tmp6875.tmpMD5
eb527779d4a920bac8c3c59e8f4b4b4c
SHA14c9c48fd4ab89a983c87d810577133dc281160b4
SHA25697a200adfccc855ed435941fe1453a6add1a66b8390d033279c2f1a6a64c26a2
SHA512a48c1ca2310a4bceacca90d3b8748fdecc0169738905e0bc62a665ab048c1ae6bb801dc99f0f04d85287993c27bfd0a4e7f59d27a1c233b6662d6ba3ca586da0
-
C:\Users\Admin\Pictures\qcxza.exeMD5
7f038b33a43afc2d9687337f963e8ab5
SHA1bfde3d1da7ae9f63050bb48d71433f3e112ad87e
SHA2568a1531470b71afbae59477a8ba23f4f0c72895700676fd3b5371a2e7f9637b86
SHA51252afc34a279f83e5b91989d8ec07d3ac5f71c46ee13e344e8e4d9c73e565596ed91d9a539266a4230318b282146da5e11dc26649bf01809977ec66c5b7405810
-
C:\Users\Admin\Pictures\qcxza.exeMD5
7f038b33a43afc2d9687337f963e8ab5
SHA1bfde3d1da7ae9f63050bb48d71433f3e112ad87e
SHA2568a1531470b71afbae59477a8ba23f4f0c72895700676fd3b5371a2e7f9637b86
SHA51252afc34a279f83e5b91989d8ec07d3ac5f71c46ee13e344e8e4d9c73e565596ed91d9a539266a4230318b282146da5e11dc26649bf01809977ec66c5b7405810
-
memory/188-271-0x0000000000000000-mapping.dmp
-
memory/200-67-0x0000000000000000-mapping.dmp
-
memory/400-10-0x0000000000000000-mapping.dmp
-
memory/420-30-0x0000000000000000-mapping.dmp
-
memory/500-60-0x0000000000000000-mapping.dmp
-
memory/508-72-0x0000000000000000-mapping.dmp
-
memory/612-58-0x0000000000000000-mapping.dmp
-
memory/640-24-0x0000000000000000-mapping.dmp
-
memory/644-106-0x0000000000000000-mapping.dmp
-
memory/648-15-0x0000000073290000-0x000000007397E000-memory.dmpFilesize
6.9MB
-
memory/648-25-0x0000000008FF0000-0x0000000008FFA000-memory.dmpFilesize
40KB
-
memory/648-27-0x0000000009160000-0x0000000009161000-memory.dmpFilesize
4KB
-
memory/648-12-0x0000000000000000-mapping.dmp
-
memory/668-307-0x0000000000000000-mapping.dmp
-
memory/740-442-0x0000000000000000-mapping.dmp
-
memory/804-53-0x0000000000000000-mapping.dmp
-
memory/848-98-0x0000000000000000-mapping.dmp
-
memory/852-80-0x0000000000000000-mapping.dmp
-
memory/900-462-0x0000000000000000-mapping.dmp
-
memory/904-292-0x0000000000000000-mapping.dmp
-
memory/936-301-0x0000000000000000-mapping.dmp
-
memory/956-208-0x0000000000000000-mapping.dmp
-
memory/968-91-0x0000000000000000-mapping.dmp
-
memory/1028-109-0x0000000000000000-mapping.dmp
-
memory/1032-40-0x0000000000000000-mapping.dmp
-
memory/1044-344-0x0000000000000000-mapping.dmp
-
memory/1112-6-0x0000000002F40000-0x0000000002F57000-memory.dmpFilesize
92KB
-
memory/1112-7-0x0000000003000000-0x000000000301F000-memory.dmpFilesize
124KB
-
memory/1112-8-0x0000000008170000-0x0000000008171000-memory.dmpFilesize
4KB
-
memory/1112-2-0x0000000073290000-0x000000007397E000-memory.dmpFilesize
6.9MB
-
memory/1112-5-0x0000000005470000-0x0000000005471000-memory.dmpFilesize
4KB
-
memory/1112-3-0x0000000000BB0000-0x0000000000BB1000-memory.dmpFilesize
4KB
-
memory/1112-9-0x0000000007D70000-0x0000000007D71000-memory.dmpFilesize
4KB
-
memory/1156-11-0x0000000000000000-mapping.dmp
-
memory/1168-26-0x0000000000000000-mapping.dmp
-
memory/1196-241-0x0000000000000000-mapping.dmp
-
memory/1212-66-0x0000000000000000-mapping.dmp
-
memory/1224-253-0x0000000000000000-mapping.dmp
-
memory/1248-57-0x0000000000000000-mapping.dmp
-
memory/1316-107-0x0000000000000000-mapping.dmp
-
memory/1328-189-0x0000000000000000-mapping.dmp
-
memory/1332-103-0x0000000000000000-mapping.dmp
-
memory/1348-46-0x0000000000000000-mapping.dmp
-
memory/1424-85-0x0000000000000000-mapping.dmp
-
memory/1468-289-0x0000000000000000-mapping.dmp
-
memory/1512-141-0x0000000000000000-mapping.dmp
-
memory/1556-168-0x0000000000000000-mapping.dmp
-
memory/1576-259-0x0000000000000000-mapping.dmp
-
memory/1604-101-0x0000000000000000-mapping.dmp
-
memory/1676-78-0x0000000000000000-mapping.dmp
-
memory/1700-90-0x0000000000000000-mapping.dmp
-
memory/1728-99-0x0000000000000000-mapping.dmp
-
memory/1732-204-0x0000000000000000-mapping.dmp
-
memory/1740-41-0x0000000002B30000-0x0000000002B31000-memory.dmpFilesize
4KB
-
memory/1740-32-0x000000000041E792-mapping.dmp
-
memory/1740-51-0x0000000006140000-0x0000000006143000-memory.dmpFilesize
12KB
-
memory/1740-48-0x0000000005190000-0x0000000005195000-memory.dmpFilesize
20KB
-
memory/1740-50-0x00000000051D0000-0x00000000051E9000-memory.dmpFilesize
100KB
-
memory/1740-31-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1740-33-0x0000000073290000-0x000000007397E000-memory.dmpFilesize
6.9MB
-
memory/1740-49-0x00000000051A0000-0x00000000051A6000-memory.dmpFilesize
24KB
-
memory/1856-167-0x0000000000000000-mapping.dmp
-
memory/1860-273-0x0000000000000000-mapping.dmp
-
memory/1872-100-0x0000000000000000-mapping.dmp
-
memory/1876-430-0x0000000000000000-mapping.dmp
-
memory/1892-166-0x0000000000000000-mapping.dmp
-
memory/2036-280-0x0000000000000000-mapping.dmp
-
memory/2060-61-0x0000000000000000-mapping.dmp
-
memory/2076-102-0x0000000000000000-mapping.dmp
-
memory/2088-140-0x0000000000000000-mapping.dmp
-
memory/2096-95-0x0000000000000000-mapping.dmp
-
memory/2100-281-0x0000000000000000-mapping.dmp
-
memory/2112-52-0x0000000000000000-mapping.dmp
-
memory/2116-392-0x0000000000000000-mapping.dmp
-
memory/2120-298-0x0000000000000000-mapping.dmp
-
memory/2160-87-0x0000000000000000-mapping.dmp
-
memory/2180-44-0x0000000000000000-mapping.dmp
-
memory/2204-226-0x0000000000000000-mapping.dmp
-
memory/2212-184-0x0000000000000000-mapping.dmp
-
memory/2228-89-0x0000000000000000-mapping.dmp
-
memory/2244-75-0x0000000000000000-mapping.dmp
-
memory/2256-69-0x0000000000000000-mapping.dmp
-
memory/2320-242-0x0000000000000000-mapping.dmp
-
memory/2356-264-0x0000000000000000-mapping.dmp
-
memory/2520-243-0x0000000000000000-mapping.dmp
-
memory/2524-299-0x0000000000000000-mapping.dmp
-
memory/2548-222-0x0000000000000000-mapping.dmp
-
memory/2600-244-0x0000000000000000-mapping.dmp
-
memory/2604-96-0x0000000000000000-mapping.dmp
-
memory/2688-59-0x0000000000000000-mapping.dmp
-
memory/2696-68-0x0000000000000000-mapping.dmp
-
memory/2756-34-0x0000000000000000-mapping.dmp
-
memory/2760-54-0x0000000000000000-mapping.dmp
-
memory/2772-55-0x0000000000000000-mapping.dmp
-
memory/2800-42-0x0000000000000000-mapping.dmp
-
memory/2872-64-0x0000000000000000-mapping.dmp
-
memory/2876-308-0x0000000000000000-mapping.dmp
-
memory/2916-88-0x0000000000000000-mapping.dmp
-
memory/3084-84-0x0000000000000000-mapping.dmp
-
memory/3192-79-0x0000000000000000-mapping.dmp
-
memory/3208-93-0x0000000000000000-mapping.dmp
-
memory/3216-250-0x0000000000000000-mapping.dmp
-
memory/3220-71-0x0000000000000000-mapping.dmp
-
memory/3232-83-0x0000000000000000-mapping.dmp
-
memory/3244-29-0x0000000000000000-mapping.dmp
-
memory/3288-92-0x0000000000000000-mapping.dmp
-
memory/3344-192-0x0000000000000000-mapping.dmp
-
memory/3400-43-0x0000000000000000-mapping.dmp
-
memory/3408-74-0x0000000000000000-mapping.dmp
-
memory/3412-65-0x0000000000000000-mapping.dmp
-
memory/3520-56-0x0000000000000000-mapping.dmp
-
memory/3540-188-0x0000000000000000-mapping.dmp
-
memory/3628-23-0x0000000000000000-mapping.dmp
-
memory/3636-77-0x0000000000000000-mapping.dmp
-
memory/3640-312-0x0000000000000000-mapping.dmp
-
memory/3660-94-0x0000000000000000-mapping.dmp
-
memory/3672-76-0x0000000000000000-mapping.dmp
-
memory/3728-82-0x0000000000000000-mapping.dmp
-
memory/3776-73-0x0000000000000000-mapping.dmp
-
memory/3812-246-0x0000000000000000-mapping.dmp
-
memory/3820-108-0x0000000000000000-mapping.dmp
-
memory/3836-97-0x0000000000000000-mapping.dmp
-
memory/3892-81-0x0000000000000000-mapping.dmp
-
memory/3900-104-0x0000000000000000-mapping.dmp
-
memory/3904-105-0x0000000000000000-mapping.dmp
-
memory/3920-63-0x0000000000000000-mapping.dmp
-
memory/3936-86-0x0000000000000000-mapping.dmp
-
memory/3944-254-0x0000000000000000-mapping.dmp
-
memory/4000-455-0x0000000000000000-mapping.dmp
-
memory/4028-267-0x0000000000000000-mapping.dmp
-
memory/4036-70-0x0000000000000000-mapping.dmp
-
memory/4056-28-0x0000000000000000-mapping.dmp
-
memory/4068-62-0x0000000000000000-mapping.dmp
-
memory/4100-275-0x0000000000000000-mapping.dmp
-
memory/4108-110-0x0000000000000000-mapping.dmp
-
memory/4112-170-0x0000000000000000-mapping.dmp
-
memory/4116-287-0x0000000000000000-mapping.dmp
-
memory/4120-143-0x0000000000000000-mapping.dmp
-
memory/4132-193-0x0000000000000000-mapping.dmp
-
memory/4136-283-0x0000000000000000-mapping.dmp
-
memory/4144-290-0x0000000000000000-mapping.dmp
-
memory/4148-169-0x0000000000000000-mapping.dmp
-
memory/4152-111-0x0000000000000000-mapping.dmp
-
memory/4156-211-0x0000000000000000-mapping.dmp
-
memory/4160-142-0x0000000000000000-mapping.dmp
-
memory/4164-209-0x0000000000000000-mapping.dmp
-
memory/4168-227-0x0000000000000000-mapping.dmp
-
memory/4176-112-0x0000000000000000-mapping.dmp
-
memory/4180-300-0x0000000000000000-mapping.dmp
-
memory/4184-210-0x0000000000000000-mapping.dmp
-
memory/4192-240-0x0000000000000000-mapping.dmp
-
memory/4200-194-0x0000000000000000-mapping.dmp
-
memory/4208-255-0x0000000000000000-mapping.dmp
-
memory/4212-172-0x0000000000000000-mapping.dmp
-
memory/4220-113-0x0000000000000000-mapping.dmp
-
memory/4224-144-0x0000000000000000-mapping.dmp
-
memory/4236-191-0x0000000000000000-mapping.dmp
-
memory/4244-114-0x0000000000000000-mapping.dmp
-
memory/4252-252-0x0000000000000000-mapping.dmp
-
memory/4256-174-0x0000000000000000-mapping.dmp
-
memory/4260-303-0x0000000000000000-mapping.dmp
-
memory/4264-228-0x0000000000000000-mapping.dmp
-
memory/4268-302-0x0000000000000000-mapping.dmp
-
memory/4272-171-0x0000000000000000-mapping.dmp
-
memory/4276-146-0x0000000000000000-mapping.dmp
-
memory/4288-115-0x0000000000000000-mapping.dmp
-
memory/4292-212-0x0000000000000000-mapping.dmp
-
memory/4296-145-0x0000000000000000-mapping.dmp
-
memory/4300-294-0x0000000000000000-mapping.dmp
-
memory/4304-239-0x0000000000000000-mapping.dmp
-
memory/4312-116-0x0000000000000000-mapping.dmp
-
memory/4316-195-0x0000000000000000-mapping.dmp
-
memory/4328-173-0x0000000000000000-mapping.dmp
-
memory/4332-148-0x0000000000000000-mapping.dmp
-
memory/4336-214-0x0000000000000000-mapping.dmp
-
memory/4352-213-0x0000000000000000-mapping.dmp
-
memory/4356-117-0x0000000000000000-mapping.dmp
-
memory/4364-274-0x0000000000000000-mapping.dmp
-
memory/4368-147-0x0000000000000000-mapping.dmp
-
memory/4380-118-0x0000000000000000-mapping.dmp
-
memory/4400-256-0x0000000000000000-mapping.dmp
-
memory/4404-215-0x0000000000000000-mapping.dmp
-
memory/4408-265-0x0000000000000000-mapping.dmp
-
memory/4412-149-0x0000000000000000-mapping.dmp
-
memory/4416-282-0x0000000000000000-mapping.dmp
-
memory/4424-119-0x0000000000000000-mapping.dmp
-
memory/4428-175-0x0000000000000000-mapping.dmp
-
memory/4432-196-0x0000000000000000-mapping.dmp
-
memory/4436-313-0x0000000000000000-mapping.dmp
-
memory/4448-120-0x0000000000000000-mapping.dmp
-
memory/4452-177-0x0000000000000000-mapping.dmp
-
memory/4456-150-0x0000000000000000-mapping.dmp
-
memory/4460-197-0x0000000000000000-mapping.dmp
-
memory/4464-276-0x0000000000000000-mapping.dmp
-
memory/4468-231-0x0000000000000000-mapping.dmp
-
memory/4480-229-0x0000000000000000-mapping.dmp
-
memory/4484-151-0x0000000000000000-mapping.dmp
-
memory/4488-198-0x0000000000000000-mapping.dmp
-
memory/4492-121-0x0000000000000000-mapping.dmp
-
memory/4500-176-0x0000000000000000-mapping.dmp
-
memory/4504-217-0x0000000000000000-mapping.dmp
-
memory/4516-122-0x0000000000000000-mapping.dmp
-
memory/4524-266-0x0000000000000000-mapping.dmp
-
memory/4536-278-0x0000000000000000-mapping.dmp
-
memory/4540-258-0x0000000000000000-mapping.dmp
-
memory/4552-257-0x0000000000000000-mapping.dmp
-
memory/4556-230-0x0000000000000000-mapping.dmp
-
memory/4560-123-0x0000000000000000-mapping.dmp
-
memory/4564-152-0x0000000000000000-mapping.dmp
-
memory/4572-277-0x0000000000000000-mapping.dmp
-
memory/4584-124-0x0000000000000000-mapping.dmp
-
memory/4588-245-0x0000000000000000-mapping.dmp
-
memory/4592-153-0x0000000000000000-mapping.dmp
-
memory/4596-180-0x0000000000000000-mapping.dmp
-
memory/4600-306-0x0000000000000000-mapping.dmp
-
memory/4604-293-0x0000000000000000-mapping.dmp
-
memory/4608-216-0x0000000000000000-mapping.dmp
-
memory/4612-154-0x0000000000000000-mapping.dmp
-
memory/4616-179-0x0000000000000000-mapping.dmp
-
memory/4624-202-0x0000000000000000-mapping.dmp
-
memory/4628-125-0x0000000000000000-mapping.dmp
-
memory/4640-178-0x0000000000000000-mapping.dmp
-
memory/4644-200-0x0000000000000000-mapping.dmp
-
memory/4652-126-0x0000000000000000-mapping.dmp
-
memory/4656-156-0x0000000000000000-mapping.dmp
-
memory/4668-218-0x0000000000000000-mapping.dmp
-
memory/4672-291-0x0000000000000000-mapping.dmp
-
memory/4676-297-0x0000000000000000-mapping.dmp
-
memory/4680-199-0x0000000000000000-mapping.dmp
-
memory/4692-232-0x0000000000000000-mapping.dmp
-
memory/4696-127-0x0000000000000000-mapping.dmp
-
memory/4700-155-0x0000000000000000-mapping.dmp
-
memory/4704-268-0x0000000000000000-mapping.dmp
-
memory/4720-128-0x0000000000000000-mapping.dmp
-
memory/4724-247-0x0000000000000000-mapping.dmp
-
memory/4728-310-0x0000000000000000-mapping.dmp
-
memory/4732-284-0x0000000000000000-mapping.dmp
-
memory/4736-182-0x0000000000000000-mapping.dmp
-
memory/4740-158-0x0000000000000000-mapping.dmp
-
memory/4744-181-0x0000000000000000-mapping.dmp
-
memory/4748-157-0x0000000000000000-mapping.dmp
-
memory/4752-201-0x0000000000000000-mapping.dmp
-
memory/4760-406-0x0000000000000000-mapping.dmp
-
memory/4764-129-0x0000000000000000-mapping.dmp
-
memory/4772-233-0x0000000000000000-mapping.dmp
-
memory/4784-220-0x0000000000000000-mapping.dmp
-
memory/4792-130-0x0000000000000000-mapping.dmp
-
memory/4796-203-0x0000000000000000-mapping.dmp
-
memory/4800-270-0x0000000000000000-mapping.dmp
-
memory/4804-160-0x0000000000000000-mapping.dmp
-
memory/4816-269-0x0000000000000000-mapping.dmp
-
memory/4820-235-0x0000000000000000-mapping.dmp
-
memory/4824-219-0x0000000000000000-mapping.dmp
-
memory/4832-159-0x0000000000000000-mapping.dmp
-
memory/4836-131-0x0000000000000000-mapping.dmp
-
memory/4840-311-0x0000000000000000-mapping.dmp
-
memory/4844-234-0x0000000000000000-mapping.dmp
-
memory/4848-261-0x0000000000000000-mapping.dmp
-
memory/4856-183-0x0000000000000000-mapping.dmp
-
memory/4864-132-0x0000000000000000-mapping.dmp
-
memory/4868-221-0x0000000000000000-mapping.dmp
-
memory/4872-260-0x0000000000000000-mapping.dmp
-
memory/4876-162-0x0000000000000000-mapping.dmp
-
memory/4880-185-0x0000000000000000-mapping.dmp
-
memory/4884-286-0x0000000000000000-mapping.dmp
-
memory/4896-249-0x0000000000000000-mapping.dmp
-
memory/4900-205-0x0000000000000000-mapping.dmp
-
memory/4904-161-0x0000000000000000-mapping.dmp
-
memory/4908-133-0x0000000000000000-mapping.dmp
-
memory/4912-248-0x0000000000000000-mapping.dmp
-
memory/4924-305-0x0000000000000000-mapping.dmp
-
memory/4932-134-0x0000000000000000-mapping.dmp
-
memory/4944-296-0x0000000000000000-mapping.dmp
-
memory/4948-288-0x0000000000000000-mapping.dmp
-
memory/4952-186-0x0000000000000000-mapping.dmp
-
memory/4956-163-0x0000000000000000-mapping.dmp
-
memory/4960-223-0x0000000000000000-mapping.dmp
-
memory/4964-236-0x0000000000000000-mapping.dmp
-
memory/4968-207-0x0000000000000000-mapping.dmp
-
memory/4976-135-0x0000000000000000-mapping.dmp
-
memory/4984-187-0x0000000000000000-mapping.dmp
-
memory/4988-295-0x0000000000000000-mapping.dmp
-
memory/4992-279-0x0000000000000000-mapping.dmp
-
memory/5000-136-0x0000000000000000-mapping.dmp
-
memory/5008-309-0x0000000000000000-mapping.dmp
-
memory/5012-165-0x0000000000000000-mapping.dmp
-
memory/5024-238-0x0000000000000000-mapping.dmp
-
memory/5028-206-0x0000000000000000-mapping.dmp
-
memory/5032-262-0x0000000000000000-mapping.dmp
-
memory/5036-263-0x0000000000000000-mapping.dmp
-
memory/5044-137-0x0000000000000000-mapping.dmp
-
memory/5048-251-0x0000000000000000-mapping.dmp
-
memory/5052-164-0x0000000000000000-mapping.dmp
-
memory/5056-237-0x0000000000000000-mapping.dmp
-
memory/5068-138-0x0000000000000000-mapping.dmp
-
memory/5072-225-0x0000000000000000-mapping.dmp
-
memory/5084-272-0x0000000000000000-mapping.dmp
-
memory/5088-304-0x0000000000000000-mapping.dmp
-
memory/5100-285-0x0000000000000000-mapping.dmp
-
memory/5104-190-0x0000000000000000-mapping.dmp
-
memory/5108-224-0x0000000000000000-mapping.dmp
-
memory/5112-139-0x0000000000000000-mapping.dmp
-
memory/5124-389-0x0000000000000000-mapping.dmp
-
memory/5132-460-0x0000000000000000-mapping.dmp
-
memory/5136-434-0x0000000000000000-mapping.dmp
-
memory/5144-314-0x0000000000000000-mapping.dmp
-
memory/5156-470-0x0000000000000000-mapping.dmp
-
memory/5160-459-0x0000000000000000-mapping.dmp
-
memory/5164-443-0x0000000000000000-mapping.dmp
-
memory/5168-346-0x0000000000000000-mapping.dmp
-
memory/5172-422-0x0000000000000000-mapping.dmp
-
memory/5180-435-0x0000000000000000-mapping.dmp
-
memory/5184-370-0x0000000000000000-mapping.dmp
-
memory/5188-315-0x0000000000000000-mapping.dmp
-
memory/5200-345-0x0000000000000000-mapping.dmp
-
memory/5204-458-0x0000000000000000-mapping.dmp
-
memory/5212-316-0x0000000000000000-mapping.dmp
-
memory/5216-452-0x0000000000000000-mapping.dmp
-
memory/5220-371-0x0000000000000000-mapping.dmp
-
memory/5224-348-0x0000000000000000-mapping.dmp
-
memory/5236-408-0x0000000000000000-mapping.dmp
-
memory/5240-372-0x0000000000000000-mapping.dmp
-
memory/5244-391-0x0000000000000000-mapping.dmp
-
memory/5248-514-0x0000000000000000-mapping.dmp
-
memory/5252-347-0x0000000000000000-mapping.dmp
-
memory/5256-317-0x0000000000000000-mapping.dmp
-
memory/5260-482-0x0000000000000000-mapping.dmp
-
memory/5268-394-0x0000000000000000-mapping.dmp
-
memory/5280-318-0x0000000000000000-mapping.dmp
-
memory/5284-425-0x0000000000000000-mapping.dmp
-
memory/5292-373-0x0000000000000000-mapping.dmp
-
memory/5296-393-0x0000000000000000-mapping.dmp
-
memory/5304-349-0x0000000000000000-mapping.dmp
-
memory/5308-410-0x0000000000000000-mapping.dmp
-
memory/5312-395-0x0000000000000000-mapping.dmp
-
memory/5324-319-0x0000000000000000-mapping.dmp
-
memory/5328-374-0x0000000000000000-mapping.dmp
-
memory/5340-409-0x0000000000000000-mapping.dmp
-
memory/5348-320-0x0000000000000000-mapping.dmp
-
memory/5352-424-0x0000000000000000-mapping.dmp
-
memory/5356-453-0x0000000000000000-mapping.dmp
-
memory/5360-351-0x0000000000000000-mapping.dmp
-
memory/5368-447-0x0000000000000000-mapping.dmp
-
memory/5372-412-0x0000000000000000-mapping.dmp
-
memory/5380-375-0x0000000000000000-mapping.dmp
-
memory/5392-321-0x0000000000000000-mapping.dmp
-
memory/5396-476-0x0000000000000000-mapping.dmp
-
memory/5400-350-0x0000000000000000-mapping.dmp
-
memory/5404-376-0x0000000000000000-mapping.dmp
-
memory/5408-464-0x0000000000000000-mapping.dmp
-
memory/5416-322-0x0000000000000000-mapping.dmp
-
memory/5424-445-0x0000000000000000-mapping.dmp
-
memory/5428-467-0x0000000000000000-mapping.dmp
-
memory/5432-411-0x0000000000000000-mapping.dmp
-
memory/5444-444-0x0000000000000000-mapping.dmp
-
memory/5452-377-0x0000000000000000-mapping.dmp
-
memory/5456-413-0x0000000000000000-mapping.dmp
-
memory/5460-323-0x0000000000000000-mapping.dmp
-
memory/5464-352-0x0000000000000000-mapping.dmp
-
memory/5476-473-0x0000000000000000-mapping.dmp
-
memory/5484-324-0x0000000000000000-mapping.dmp
-
memory/5488-354-0x0000000000000000-mapping.dmp
-
memory/5496-481-0x0000000000000000-mapping.dmp
-
memory/5508-477-0x0000000000000000-mapping.dmp
-
memory/5512-396-0x0000000000000000-mapping.dmp
-
memory/5516-414-0x0000000000000000-mapping.dmp
-
memory/5520-379-0x0000000000000000-mapping.dmp
-
memory/5528-325-0x0000000000000000-mapping.dmp
-
memory/5532-426-0x0000000000000000-mapping.dmp
-
memory/5536-353-0x0000000000000000-mapping.dmp
-
memory/5540-397-0x0000000000000000-mapping.dmp
-
memory/5544-446-0x0000000000000000-mapping.dmp
-
memory/5552-326-0x0000000000000000-mapping.dmp
-
memory/5556-438-0x0000000000000000-mapping.dmp
-
memory/5560-448-0x0000000000000000-mapping.dmp
-
memory/5564-454-0x0000000000000000-mapping.dmp
-
memory/5568-461-0x0000000000000000-mapping.dmp
-
memory/5572-399-0x0000000000000000-mapping.dmp
-
memory/5580-415-0x0000000000000000-mapping.dmp
-
memory/5588-356-0x0000000000000000-mapping.dmp
-
memory/5592-378-0x0000000000000000-mapping.dmp
-
memory/5596-327-0x0000000000000000-mapping.dmp
-
memory/5600-355-0x0000000000000000-mapping.dmp
-
memory/5608-428-0x0000000000000000-mapping.dmp
-
memory/5620-328-0x0000000000000000-mapping.dmp
-
memory/5624-398-0x0000000000000000-mapping.dmp
-
memory/5632-358-0x0000000000000000-mapping.dmp
-
memory/5652-380-0x0000000000000000-mapping.dmp
-
memory/5660-357-0x0000000000000000-mapping.dmp
-
memory/5664-329-0x0000000000000000-mapping.dmp
-
memory/5672-474-0x0000000000000000-mapping.dmp
-
memory/5676-479-0x0000000000000000-mapping.dmp
-
memory/5680-480-0x0000000000000000-mapping.dmp
-
memory/5688-330-0x0000000000000000-mapping.dmp
-
memory/5704-437-0x0000000000000000-mapping.dmp
-
memory/5708-359-0x0000000000000000-mapping.dmp
-
memory/5720-381-0x0000000000000000-mapping.dmp
-
memory/5724-427-0x0000000000000000-mapping.dmp
-
memory/5728-382-0x0000000000000000-mapping.dmp
-
memory/5732-331-0x0000000000000000-mapping.dmp
-
memory/5736-400-0x0000000000000000-mapping.dmp
-
memory/5740-417-0x0000000000000000-mapping.dmp
-
memory/5748-475-0x0000000000000000-mapping.dmp
-
memory/5756-332-0x0000000000000000-mapping.dmp
-
memory/5760-466-0x0000000000000000-mapping.dmp
-
memory/5768-361-0x0000000000000000-mapping.dmp
-
memory/5780-401-0x0000000000000000-mapping.dmp
-
memory/5792-384-0x0000000000000000-mapping.dmp
-
memory/5796-440-0x0000000000000000-mapping.dmp
-
memory/5800-333-0x0000000000000000-mapping.dmp
-
memory/5804-439-0x0000000000000000-mapping.dmp
-
memory/5808-360-0x0000000000000000-mapping.dmp
-
memory/5812-402-0x0000000000000000-mapping.dmp
-
memory/5824-334-0x0000000000000000-mapping.dmp
-
memory/5832-383-0x0000000000000000-mapping.dmp
-
memory/5836-403-0x0000000000000000-mapping.dmp
-
memory/5840-416-0x0000000000000000-mapping.dmp
-
memory/5844-478-0x0000000000000000-mapping.dmp
-
memory/5848-432-0x0000000000000000-mapping.dmp
-
memory/5852-468-0x0000000000000000-mapping.dmp
-
memory/5856-404-0x0000000000000000-mapping.dmp
-
memory/5864-362-0x0000000000000000-mapping.dmp
-
memory/5868-335-0x0000000000000000-mapping.dmp
-
memory/5880-436-0x0000000000000000-mapping.dmp
-
memory/5892-336-0x0000000000000000-mapping.dmp
-
memory/5896-364-0x0000000000000000-mapping.dmp
-
memory/5900-385-0x0000000000000000-mapping.dmp
-
memory/5904-441-0x0000000000000000-mapping.dmp
-
memory/5908-456-0x0000000000000000-mapping.dmp
-
memory/5920-418-0x0000000000000000-mapping.dmp
-
memory/5928-386-0x0000000000000000-mapping.dmp
-
memory/5936-337-0x0000000000000000-mapping.dmp
-
memory/5944-429-0x0000000000000000-mapping.dmp
-
memory/5952-363-0x0000000000000000-mapping.dmp
-
memory/5960-338-0x0000000000000000-mapping.dmp
-
memory/5964-469-0x0000000000000000-mapping.dmp
-
memory/5968-471-0x0000000000000000-mapping.dmp
-
memory/5972-451-0x0000000000000000-mapping.dmp
-
memory/5976-449-0x0000000000000000-mapping.dmp
-
memory/5980-366-0x0000000000000000-mapping.dmp
-
memory/5984-419-0x0000000000000000-mapping.dmp
-
memory/5988-450-0x0000000000000000-mapping.dmp
-
memory/6000-365-0x0000000000000000-mapping.dmp
-
memory/6004-339-0x0000000000000000-mapping.dmp
-
memory/6008-463-0x0000000000000000-mapping.dmp
-
memory/6012-405-0x0000000000000000-mapping.dmp
-
memory/6016-387-0x0000000000000000-mapping.dmp
-
memory/6020-420-0x0000000000000000-mapping.dmp
-
memory/6028-340-0x0000000000000000-mapping.dmp
-
memory/6032-367-0x0000000000000000-mapping.dmp
-
memory/6040-388-0x0000000000000000-mapping.dmp
-
memory/6048-483-0x0000000000000000-mapping.dmp
-
memory/6052-431-0x0000000000000000-mapping.dmp
-
memory/6056-421-0x0000000000000000-mapping.dmp
-
memory/6068-465-0x0000000000000000-mapping.dmp
-
memory/6072-341-0x0000000000000000-mapping.dmp
-
memory/6076-407-0x0000000000000000-mapping.dmp
-
memory/6088-457-0x0000000000000000-mapping.dmp
-
memory/6096-342-0x0000000000000000-mapping.dmp
-
memory/6112-368-0x0000000000000000-mapping.dmp
-
memory/6116-369-0x0000000000000000-mapping.dmp
-
memory/6124-433-0x0000000000000000-mapping.dmp
-
memory/6128-390-0x0000000000000000-mapping.dmp
-
memory/6132-472-0x0000000000000000-mapping.dmp
-
memory/6136-423-0x0000000000000000-mapping.dmp
-
memory/6140-343-0x0000000000000000-mapping.dmp
-
memory/6156-484-0x0000000000000000-mapping.dmp
-
memory/6160-516-0x0000000000000000-mapping.dmp
-
memory/6200-485-0x0000000000000000-mapping.dmp
-
memory/6216-515-0x0000000000000000-mapping.dmp
-
memory/6224-486-0x0000000000000000-mapping.dmp
-
memory/6260-518-0x0000000000000000-mapping.dmp
-
memory/6268-487-0x0000000000000000-mapping.dmp
-
memory/6284-517-0x0000000000000000-mapping.dmp
-
memory/6296-488-0x0000000000000000-mapping.dmp
-
memory/6328-519-0x0000000000000000-mapping.dmp
-
memory/6340-489-0x0000000000000000-mapping.dmp
-
memory/6364-490-0x0000000000000000-mapping.dmp
-
memory/6372-520-0x0000000000000000-mapping.dmp
-
memory/6400-521-0x0000000000000000-mapping.dmp
-
memory/6408-491-0x0000000000000000-mapping.dmp
-
memory/6432-492-0x0000000000000000-mapping.dmp
-
memory/6476-493-0x0000000000000000-mapping.dmp
-
memory/6492-522-0x0000000000000000-mapping.dmp
-
memory/6500-494-0x0000000000000000-mapping.dmp
-
memory/6508-523-0x0000000000000000-mapping.dmp
-
memory/6540-524-0x0000000000000000-mapping.dmp
-
memory/6544-495-0x0000000000000000-mapping.dmp
-
memory/6568-496-0x0000000000000000-mapping.dmp
-
memory/6592-526-0x0000000000000000-mapping.dmp
-
memory/6612-497-0x0000000000000000-mapping.dmp
-
memory/6624-525-0x0000000000000000-mapping.dmp
-
memory/6636-498-0x0000000000000000-mapping.dmp
-
memory/6664-527-0x0000000000000000-mapping.dmp
-
memory/6680-499-0x0000000000000000-mapping.dmp
-
memory/6704-500-0x0000000000000000-mapping.dmp
-
memory/6748-501-0x0000000000000000-mapping.dmp
-
memory/6772-502-0x0000000000000000-mapping.dmp
-
memory/6816-503-0x0000000000000000-mapping.dmp
-
memory/6840-504-0x0000000000000000-mapping.dmp
-
memory/6884-505-0x0000000000000000-mapping.dmp
-
memory/6908-506-0x0000000000000000-mapping.dmp
-
memory/6952-507-0x0000000000000000-mapping.dmp
-
memory/6976-508-0x0000000000000000-mapping.dmp
-
memory/7020-509-0x0000000000000000-mapping.dmp
-
memory/7044-510-0x0000000000000000-mapping.dmp
-
memory/7088-511-0x0000000000000000-mapping.dmp
-
memory/7112-512-0x0000000000000000-mapping.dmp
-
memory/7156-513-0x0000000000000000-mapping.dmp