Analysis
-
max time kernel
151s -
max time network
133s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
04-12-2020 18:27
Static task
static1
Behavioral task
behavioral1
Sample
PAYMENT COPY.exe
Resource
win7v20201028
General
-
Target
PAYMENT COPY.exe
-
Size
585KB
-
MD5
7f038b33a43afc2d9687337f963e8ab5
-
SHA1
bfde3d1da7ae9f63050bb48d71433f3e112ad87e
-
SHA256
8a1531470b71afbae59477a8ba23f4f0c72895700676fd3b5371a2e7f9637b86
-
SHA512
52afc34a279f83e5b91989d8ec07d3ac5f71c46ee13e344e8e4d9c73e565596ed91d9a539266a4230318b282146da5e11dc26649bf01809977ec66c5b7405810
Malware Config
Extracted
nanocore
1.2.2.0
e12345.ddns.net:9034
79.134.225.22:9034
b92fa5b2-56be-4ad1-a2f0-1fdcc67d7c0b
-
activate_away_mode
false
-
backup_connection_host
79.134.225.22
- backup_dns_server
-
buffer_size
65538
-
build_time
2020-09-03T11:34:59.807683136Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
false
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
9034
-
default_group
TODAY2020
-
enable_debug_mode
true
-
gc_threshold
1.0485772e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.0485772e+07
-
mutex
b92fa5b2-56be-4ad1-a2f0-1fdcc67d7c0b
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
e12345.ddns.net
- primary_dns_server
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
false
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8009
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
qcxza.exepid process 1148 qcxza.exe -
Loads dropped DLL 1 IoCs
Processes:
cmd.exepid process 1156 cmd.exe -
Adds Run key to start application 2 TTPs 429 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exeInstallUtil.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\qcxza = "C:\\Users\\Admin\\Pictures\\qcxza.exe" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\qcxza = "C:\\Users\\Admin\\Pictures\\qcxza.exe" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\qcxza = "C:\\Users\\Admin\\Pictures\\qcxza.exe" reg.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\qcxza = "C:\\Users\\Admin\\Pictures\\qcxza.exe" reg.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\qcxza = "C:\\Users\\Admin\\Pictures\\qcxza.exe" reg.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\qcxza = "C:\\Users\\Admin\\Pictures\\qcxza.exe" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\qcxza = "C:\\Users\\Admin\\Pictures\\qcxza.exe" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\qcxza = "C:\\Users\\Admin\\Pictures\\qcxza.exe" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\qcxza = "C:\\Users\\Admin\\Pictures\\qcxza.exe" reg.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\qcxza = "C:\\Users\\Admin\\Pictures\\qcxza.exe" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\qcxza = "C:\\Users\\Admin\\Pictures\\qcxza.exe" reg.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\qcxza = "C:\\Users\\Admin\\Pictures\\qcxza.exe" reg.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\qcxza = "C:\\Users\\Admin\\Pictures\\qcxza.exe" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\qcxza = "C:\\Users\\Admin\\Pictures\\qcxza.exe" reg.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\qcxza = "C:\\Users\\Admin\\Pictures\\qcxza.exe" reg.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\qcxza = "C:\\Users\\Admin\\Pictures\\qcxza.exe" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\qcxza = "C:\\Users\\Admin\\Pictures\\qcxza.exe" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\qcxza = "C:\\Users\\Admin\\Pictures\\qcxza.exe" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\qcxza = "C:\\Users\\Admin\\Pictures\\qcxza.exe" reg.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\qcxza = "C:\\Users\\Admin\\Pictures\\qcxza.exe" reg.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\qcxza = "C:\\Users\\Admin\\Pictures\\qcxza.exe" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\qcxza = "C:\\Users\\Admin\\Pictures\\qcxza.exe" reg.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\qcxza = "C:\\Users\\Admin\\Pictures\\qcxza.exe" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\qcxza = "C:\\Users\\Admin\\Pictures\\qcxza.exe" reg.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\qcxza = "C:\\Users\\Admin\\Pictures\\qcxza.exe" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\qcxza = "C:\\Users\\Admin\\Pictures\\qcxza.exe" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\qcxza = "C:\\Users\\Admin\\Pictures\\qcxza.exe" reg.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\qcxza = "C:\\Users\\Admin\\Pictures\\qcxza.exe" reg.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\qcxza = "C:\\Users\\Admin\\Pictures\\qcxza.exe" reg.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\qcxza = "C:\\Users\\Admin\\Pictures\\qcxza.exe" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\qcxza = "C:\\Users\\Admin\\Pictures\\qcxza.exe" reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\NTFS Manager = "C:\\Program Files (x86)\\NTFS Manager\\ntfsmgr.exe" InstallUtil.exe Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\qcxza = "C:\\Users\\Admin\\Pictures\\qcxza.exe" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\qcxza = "C:\\Users\\Admin\\Pictures\\qcxza.exe" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\qcxza = "C:\\Users\\Admin\\Pictures\\qcxza.exe" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\qcxza = "C:\\Users\\Admin\\Pictures\\qcxza.exe" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\qcxza = "C:\\Users\\Admin\\Pictures\\qcxza.exe" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\qcxza = "C:\\Users\\Admin\\Pictures\\qcxza.exe" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\qcxza = "C:\\Users\\Admin\\Pictures\\qcxza.exe" reg.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
qcxza.exedescription pid process target process PID 1148 set thread context of 532 1148 qcxza.exe InstallUtil.exe -
Drops file in Program Files directory 2 IoCs
Processes:
InstallUtil.exedescription ioc process File created C:\Program Files (x86)\NTFS Manager\ntfsmgr.exe InstallUtil.exe File opened for modification C:\Program Files (x86)\NTFS Manager\ntfsmgr.exe InstallUtil.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 1412 schtasks.exe 1668 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
qcxza.exeInstallUtil.exepid process 1148 qcxza.exe 1148 qcxza.exe 532 InstallUtil.exe 532 InstallUtil.exe 532 InstallUtil.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
Processes:
InstallUtil.exeqcxza.exepid process 532 InstallUtil.exe 1148 qcxza.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
PAYMENT COPY.exeqcxza.exeInstallUtil.exedescription pid process Token: SeDebugPrivilege 1204 PAYMENT COPY.exe Token: SeDebugPrivilege 1148 qcxza.exe Token: SeDebugPrivilege 532 InstallUtil.exe Token: SeDebugPrivilege 532 InstallUtil.exe -
Suspicious use of WriteProcessMemory 1744 IoCs
Processes:
PAYMENT COPY.execmd.exeqcxza.execmd.execmd.execmd.execmd.exeInstallUtil.exedescription pid process target process PID 1204 wrote to memory of 2040 1204 PAYMENT COPY.exe cmd.exe PID 1204 wrote to memory of 2040 1204 PAYMENT COPY.exe cmd.exe PID 1204 wrote to memory of 2040 1204 PAYMENT COPY.exe cmd.exe PID 1204 wrote to memory of 2040 1204 PAYMENT COPY.exe cmd.exe PID 1204 wrote to memory of 1156 1204 PAYMENT COPY.exe cmd.exe PID 1204 wrote to memory of 1156 1204 PAYMENT COPY.exe cmd.exe PID 1204 wrote to memory of 1156 1204 PAYMENT COPY.exe cmd.exe PID 1204 wrote to memory of 1156 1204 PAYMENT COPY.exe cmd.exe PID 1156 wrote to memory of 1148 1156 cmd.exe qcxza.exe PID 1156 wrote to memory of 1148 1156 cmd.exe qcxza.exe PID 1156 wrote to memory of 1148 1156 cmd.exe qcxza.exe PID 1156 wrote to memory of 1148 1156 cmd.exe qcxza.exe PID 1148 wrote to memory of 1300 1148 qcxza.exe cmd.exe PID 1148 wrote to memory of 1300 1148 qcxza.exe cmd.exe PID 1148 wrote to memory of 1300 1148 qcxza.exe cmd.exe PID 1148 wrote to memory of 1300 1148 qcxza.exe cmd.exe PID 1300 wrote to memory of 744 1300 cmd.exe reg.exe PID 1300 wrote to memory of 744 1300 cmd.exe reg.exe PID 1300 wrote to memory of 744 1300 cmd.exe reg.exe PID 1300 wrote to memory of 744 1300 cmd.exe reg.exe PID 1148 wrote to memory of 648 1148 qcxza.exe cmd.exe PID 1148 wrote to memory of 648 1148 qcxza.exe cmd.exe PID 1148 wrote to memory of 648 1148 qcxza.exe cmd.exe PID 1148 wrote to memory of 648 1148 qcxza.exe cmd.exe PID 648 wrote to memory of 428 648 cmd.exe reg.exe PID 648 wrote to memory of 428 648 cmd.exe reg.exe PID 648 wrote to memory of 428 648 cmd.exe reg.exe PID 648 wrote to memory of 428 648 cmd.exe reg.exe PID 1148 wrote to memory of 532 1148 qcxza.exe InstallUtil.exe PID 1148 wrote to memory of 532 1148 qcxza.exe InstallUtil.exe PID 1148 wrote to memory of 532 1148 qcxza.exe InstallUtil.exe PID 1148 wrote to memory of 532 1148 qcxza.exe InstallUtil.exe PID 1148 wrote to memory of 532 1148 qcxza.exe InstallUtil.exe PID 1148 wrote to memory of 532 1148 qcxza.exe InstallUtil.exe PID 1148 wrote to memory of 532 1148 qcxza.exe InstallUtil.exe PID 1148 wrote to memory of 532 1148 qcxza.exe InstallUtil.exe PID 1148 wrote to memory of 532 1148 qcxza.exe InstallUtil.exe PID 1148 wrote to memory of 532 1148 qcxza.exe InstallUtil.exe PID 1148 wrote to memory of 532 1148 qcxza.exe InstallUtil.exe PID 1148 wrote to memory of 532 1148 qcxza.exe InstallUtil.exe PID 1148 wrote to memory of 956 1148 qcxza.exe cmd.exe PID 1148 wrote to memory of 956 1148 qcxza.exe cmd.exe PID 1148 wrote to memory of 956 1148 qcxza.exe cmd.exe PID 1148 wrote to memory of 956 1148 qcxza.exe cmd.exe PID 956 wrote to memory of 1880 956 cmd.exe reg.exe PID 956 wrote to memory of 1880 956 cmd.exe reg.exe PID 956 wrote to memory of 1880 956 cmd.exe reg.exe PID 956 wrote to memory of 1880 956 cmd.exe reg.exe PID 1148 wrote to memory of 1532 1148 qcxza.exe cmd.exe PID 1148 wrote to memory of 1532 1148 qcxza.exe cmd.exe PID 1148 wrote to memory of 1532 1148 qcxza.exe cmd.exe PID 1148 wrote to memory of 1532 1148 qcxza.exe cmd.exe PID 1532 wrote to memory of 1556 1532 cmd.exe reg.exe PID 1532 wrote to memory of 1556 1532 cmd.exe reg.exe PID 1532 wrote to memory of 1556 1532 cmd.exe reg.exe PID 1532 wrote to memory of 1556 1532 cmd.exe reg.exe PID 532 wrote to memory of 1668 532 InstallUtil.exe schtasks.exe PID 532 wrote to memory of 1668 532 InstallUtil.exe schtasks.exe PID 532 wrote to memory of 1668 532 InstallUtil.exe schtasks.exe PID 532 wrote to memory of 1668 532 InstallUtil.exe schtasks.exe PID 532 wrote to memory of 1412 532 InstallUtil.exe schtasks.exe PID 532 wrote to memory of 1412 532 InstallUtil.exe schtasks.exe PID 532 wrote to memory of 1412 532 InstallUtil.exe schtasks.exe PID 532 wrote to memory of 1412 532 InstallUtil.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PAYMENT COPY.exe"C:\Users\Admin\AppData\Local\Temp\PAYMENT COPY.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\PAYMENT COPY.exe" "C:\Users\Admin\Pictures\qcxza.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c, "C:\Users\Admin\Pictures\qcxza.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Pictures\qcxza.exe"C:\Users\Admin\Pictures\qcxza.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"4⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "NTFS Manager" /xml "C:\Users\Admin\AppData\Local\Temp\tmp4C5C.tmp"5⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "NTFS Manager Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp4D95.tmp"5⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp4C5C.tmpMD5
576bbaf398045c3843d452ec83208236
SHA18ed5b2500ae7a40cbfa6e9018a1d1f1e70cb1374
SHA25633c0c2d72fa383e5988ce640febc5ac6a2bd71d4ae660b99e52234952e17467b
SHA512e7cc0ea0b351c6a8618e14f03c00e88ef83e2f169e0b4d66513f580f0a9352fbfe429e57186362b69407150d566bbdadca2f7b574fc748cc140b3249be67f96a
-
C:\Users\Admin\AppData\Local\Temp\tmp4D95.tmpMD5
41808f05a9aa523d0ef506d4993f1d6c
SHA15a228145decf63ebbbd673c9b7c08a86236a22d4
SHA256f76bd5da395a725b5998efab9a5d3160657cf2d44a8be83fa24af6ba29acf731
SHA5127cf71f8fd8dccaa8cf2c724afca3178be8b7a6e0cc6e4b44990e96413bd0dac8248e2bcfa1bb82da05efb6c4b46649722c20ce14cf4a44f1720e18732bd9246e
-
C:\Users\Admin\Pictures\qcxza.exeMD5
7f038b33a43afc2d9687337f963e8ab5
SHA1bfde3d1da7ae9f63050bb48d71433f3e112ad87e
SHA2568a1531470b71afbae59477a8ba23f4f0c72895700676fd3b5371a2e7f9637b86
SHA51252afc34a279f83e5b91989d8ec07d3ac5f71c46ee13e344e8e4d9c73e565596ed91d9a539266a4230318b282146da5e11dc26649bf01809977ec66c5b7405810
-
C:\Users\Admin\Pictures\qcxza.exeMD5
7f038b33a43afc2d9687337f963e8ab5
SHA1bfde3d1da7ae9f63050bb48d71433f3e112ad87e
SHA2568a1531470b71afbae59477a8ba23f4f0c72895700676fd3b5371a2e7f9637b86
SHA51252afc34a279f83e5b91989d8ec07d3ac5f71c46ee13e344e8e4d9c73e565596ed91d9a539266a4230318b282146da5e11dc26649bf01809977ec66c5b7405810
-
\Users\Admin\Pictures\qcxza.exeMD5
7f038b33a43afc2d9687337f963e8ab5
SHA1bfde3d1da7ae9f63050bb48d71433f3e112ad87e
SHA2568a1531470b71afbae59477a8ba23f4f0c72895700676fd3b5371a2e7f9637b86
SHA51252afc34a279f83e5b91989d8ec07d3ac5f71c46ee13e344e8e4d9c73e565596ed91d9a539266a4230318b282146da5e11dc26649bf01809977ec66c5b7405810
-
memory/268-72-0x0000000000000000-mapping.dmp
-
memory/428-22-0x0000000000000000-mapping.dmp
-
memory/428-94-0x0000000000000000-mapping.dmp
-
memory/468-56-0x0000000000000000-mapping.dmp
-
memory/520-44-0x0000000000000000-mapping.dmp
-
memory/532-38-0x00000000005A0000-0x00000000005A5000-memory.dmpFilesize
20KB
-
memory/532-29-0x0000000074030000-0x000000007471E000-memory.dmpFilesize
6.9MB
-
memory/532-41-0x00000000007C0000-0x00000000007C3000-memory.dmpFilesize
12KB
-
memory/532-39-0x00000000005B0000-0x00000000005B6000-memory.dmpFilesize
24KB
-
memory/532-40-0x0000000000B30000-0x0000000000B49000-memory.dmpFilesize
100KB
-
memory/532-25-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/532-26-0x000000000041E792-mapping.dmp
-
memory/532-27-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/532-28-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/568-340-0x0000000000000000-mapping.dmp
-
memory/604-93-0x0000000000000000-mapping.dmp
-
memory/612-68-0x0000000000000000-mapping.dmp
-
memory/648-21-0x0000000000000000-mapping.dmp
-
memory/660-113-0x0000000000000000-mapping.dmp
-
memory/660-115-0x0000000000000000-mapping.dmp
-
memory/660-65-0x0000000000000000-mapping.dmp
-
memory/660-45-0x0000000000000000-mapping.dmp
-
memory/660-121-0x0000000000000000-mapping.dmp
-
memory/660-111-0x0000000000000000-mapping.dmp
-
memory/680-286-0x0000000000000000-mapping.dmp
-
memory/744-43-0x0000000000000000-mapping.dmp
-
memory/744-19-0x0000000000000000-mapping.dmp
-
memory/748-92-0x0000000000000000-mapping.dmp
-
memory/748-87-0x0000000000000000-mapping.dmp
-
memory/768-64-0x0000000000000000-mapping.dmp
-
memory/792-108-0x0000000000000000-mapping.dmp
-
memory/904-103-0x0000000000000000-mapping.dmp
-
memory/904-118-0x0000000000000000-mapping.dmp
-
memory/908-107-0x0000000000000000-mapping.dmp
-
memory/908-110-0x0000000000000000-mapping.dmp
-
memory/920-47-0x0000000000000000-mapping.dmp
-
memory/920-58-0x0000000000000000-mapping.dmp
-
memory/936-112-0x0000000000000000-mapping.dmp
-
memory/940-105-0x0000000000000000-mapping.dmp
-
memory/956-23-0x0000000000000000-mapping.dmp
-
memory/960-109-0x0000000000000000-mapping.dmp
-
memory/1004-46-0x0000000000000000-mapping.dmp
-
memory/1016-353-0x0000000000000000-mapping.dmp
-
memory/1040-381-0x0000000000000000-mapping.dmp
-
memory/1048-261-0x0000000000000000-mapping.dmp
-
memory/1048-393-0x0000000000000000-mapping.dmp
-
memory/1048-395-0x0000000000000000-mapping.dmp
-
memory/1060-342-0x0000000000000000-mapping.dmp
-
memory/1060-119-0x0000000000000000-mapping.dmp
-
memory/1096-82-0x0000000000000000-mapping.dmp
-
memory/1096-75-0x0000000000000000-mapping.dmp
-
memory/1148-13-0x0000000074030000-0x000000007471E000-memory.dmpFilesize
6.9MB
-
memory/1148-14-0x00000000012F0000-0x00000000012F1000-memory.dmpFilesize
4KB
-
memory/1148-20-0x0000000000DC0000-0x0000000000DCA000-memory.dmpFilesize
40KB
-
memory/1148-11-0x0000000000000000-mapping.dmp
-
memory/1156-8-0x0000000000000000-mapping.dmp
-
memory/1204-2-0x00000000740B0000-0x000000007479E000-memory.dmpFilesize
6.9MB
-
memory/1204-6-0x00000000004F0000-0x000000000050F000-memory.dmpFilesize
124KB
-
memory/1204-3-0x0000000001060000-0x0000000001061000-memory.dmpFilesize
4KB
-
memory/1204-5-0x0000000000350000-0x0000000000367000-memory.dmpFilesize
92KB
-
memory/1212-51-0x0000000000000000-mapping.dmp
-
memory/1232-326-0x0000000000000000-mapping.dmp
-
memory/1232-263-0x0000000000000000-mapping.dmp
-
memory/1292-106-0x0000000000000000-mapping.dmp
-
memory/1292-71-0x0000000000000000-mapping.dmp
-
memory/1300-18-0x0000000000000000-mapping.dmp
-
memory/1304-117-0x0000000000000000-mapping.dmp
-
memory/1304-311-0x0000000000000000-mapping.dmp
-
memory/1304-328-0x0000000000000000-mapping.dmp
-
memory/1332-305-0x0000000000000000-mapping.dmp
-
memory/1352-456-0x0000000000000000-mapping.dmp
-
memory/1384-355-0x0000000000000000-mapping.dmp
-
memory/1412-36-0x0000000000000000-mapping.dmp
-
memory/1488-50-0x0000000000000000-mapping.dmp
-
memory/1504-86-0x0000000000000000-mapping.dmp
-
memory/1532-30-0x0000000000000000-mapping.dmp
-
memory/1536-252-0x0000000000000000-mapping.dmp
-
memory/1556-49-0x0000000000000000-mapping.dmp
-
memory/1556-33-0x0000000000000000-mapping.dmp
-
memory/1556-67-0x0000000000000000-mapping.dmp
-
memory/1572-454-0x0000000000000000-mapping.dmp
-
memory/1576-80-0x0000000000000000-mapping.dmp
-
memory/1580-385-0x0000000000000000-mapping.dmp
-
memory/1584-60-0x0000000000000000-mapping.dmp
-
memory/1588-98-0x0000000000000000-mapping.dmp
-
memory/1592-168-0x0000000000000000-mapping.dmp
-
memory/1604-55-0x0000000000000000-mapping.dmp
-
memory/1604-90-0x0000000000000000-mapping.dmp
-
memory/1616-88-0x0000000000000000-mapping.dmp
-
memory/1632-351-0x0000000000000000-mapping.dmp
-
memory/1640-74-0x0000000000000000-mapping.dmp
-
memory/1644-99-0x0000000000000000-mapping.dmp
-
memory/1644-69-0x0000000000000000-mapping.dmp
-
memory/1664-114-0x0000000000000000-mapping.dmp
-
memory/1668-34-0x0000000000000000-mapping.dmp
-
memory/1676-54-0x0000000000000000-mapping.dmp
-
memory/1688-63-0x0000000000000000-mapping.dmp
-
memory/1696-42-0x0000000000000000-mapping.dmp
-
memory/1704-77-0x0000000000000000-mapping.dmp
-
memory/1704-100-0x0000000000000000-mapping.dmp
-
memory/1708-76-0x0000000000000000-mapping.dmp
-
memory/1712-66-0x0000000000000000-mapping.dmp
-
memory/1712-57-0x0000000000000000-mapping.dmp
-
memory/1716-276-0x0000000000000000-mapping.dmp
-
memory/1728-96-0x0000000000000000-mapping.dmp
-
memory/1732-300-0x0000000000000000-mapping.dmp
-
memory/1744-85-0x0000000000000000-mapping.dmp
-
memory/1744-79-0x0000000000000000-mapping.dmp
-
memory/1752-249-0x0000000000000000-mapping.dmp
-
memory/1752-386-0x0000000000000000-mapping.dmp
-
memory/1764-59-0x0000000000000000-mapping.dmp
-
memory/1780-95-0x0000000000000000-mapping.dmp
-
memory/1780-73-0x0000000000000000-mapping.dmp
-
memory/1780-91-0x0000000000000000-mapping.dmp
-
memory/1780-104-0x0000000000000000-mapping.dmp
-
memory/1788-352-0x0000000000000000-mapping.dmp
-
memory/1788-287-0x0000000000000000-mapping.dmp
-
memory/1804-102-0x0000000000000000-mapping.dmp
-
memory/1816-78-0x0000000000000000-mapping.dmp
-
memory/1824-116-0x0000000000000000-mapping.dmp
-
memory/1836-260-0x0000000000000000-mapping.dmp
-
memory/1844-70-0x0000000000000000-mapping.dmp
-
memory/1844-53-0x0000000000000000-mapping.dmp
-
memory/1864-48-0x0000000000000000-mapping.dmp
-
memory/1872-250-0x0000000000000000-mapping.dmp
-
memory/1876-339-0x0000000000000000-mapping.dmp
-
memory/1876-369-0x0000000000000000-mapping.dmp
-
memory/1876-361-0x0000000000000000-mapping.dmp
-
memory/1880-120-0x0000000000000000-mapping.dmp
-
memory/1880-24-0x0000000000000000-mapping.dmp
-
memory/1880-81-0x0000000000000000-mapping.dmp
-
memory/1932-332-0x0000000000000000-mapping.dmp
-
memory/1960-89-0x0000000000000000-mapping.dmp
-
memory/1976-62-0x0000000000000000-mapping.dmp
-
memory/1988-101-0x0000000000000000-mapping.dmp
-
memory/1996-61-0x0000000000000000-mapping.dmp
-
memory/1996-84-0x0000000000000000-mapping.dmp
-
memory/2012-97-0x0000000000000000-mapping.dmp
-
memory/2012-83-0x0000000000000000-mapping.dmp
-
memory/2028-52-0x0000000000000000-mapping.dmp
-
memory/2040-7-0x0000000000000000-mapping.dmp
-
memory/2052-292-0x0000000000000000-mapping.dmp
-
memory/2056-205-0x0000000000000000-mapping.dmp
-
memory/2056-236-0x0000000000000000-mapping.dmp
-
memory/2068-122-0x0000000000000000-mapping.dmp
-
memory/2072-266-0x0000000000000000-mapping.dmp
-
memory/2076-363-0x0000000000000000-mapping.dmp
-
memory/2076-267-0x0000000000000000-mapping.dmp
-
memory/2084-237-0x0000000000000000-mapping.dmp
-
memory/2088-170-0x0000000000000000-mapping.dmp
-
memory/2096-123-0x0000000000000000-mapping.dmp
-
memory/2100-169-0x0000000000000000-mapping.dmp
-
memory/2104-396-0x0000000000000000-mapping.dmp
-
memory/2104-207-0x0000000000000000-mapping.dmp
-
memory/2112-124-0x0000000000000000-mapping.dmp
-
memory/2116-354-0x0000000000000000-mapping.dmp
-
memory/2116-171-0x0000000000000000-mapping.dmp
-
memory/2120-208-0x0000000000000000-mapping.dmp
-
memory/2128-373-0x0000000000000000-mapping.dmp
-
memory/2128-399-0x0000000000000000-mapping.dmp
-
memory/2132-330-0x0000000000000000-mapping.dmp
-
memory/2136-240-0x0000000000000000-mapping.dmp
-
memory/2140-125-0x0000000000000000-mapping.dmp
-
memory/2144-239-0x0000000000000000-mapping.dmp
-
memory/2144-209-0x0000000000000000-mapping.dmp
-
memory/2144-268-0x0000000000000000-mapping.dmp
-
memory/2148-291-0x0000000000000000-mapping.dmp
-
memory/2148-390-0x0000000000000000-mapping.dmp
-
memory/2156-126-0x0000000000000000-mapping.dmp
-
memory/2164-172-0x0000000000000000-mapping.dmp
-
memory/2168-210-0x0000000000000000-mapping.dmp
-
memory/2180-364-0x0000000000000000-mapping.dmp
-
memory/2180-173-0x0000000000000000-mapping.dmp
-
memory/2184-127-0x0000000000000000-mapping.dmp
-
memory/2188-388-0x0000000000000000-mapping.dmp
-
memory/2188-313-0x0000000000000000-mapping.dmp
-
memory/2200-128-0x0000000000000000-mapping.dmp
-
memory/2204-211-0x0000000000000000-mapping.dmp
-
memory/2204-270-0x0000000000000000-mapping.dmp
-
memory/2212-242-0x0000000000000000-mapping.dmp
-
memory/2220-212-0x0000000000000000-mapping.dmp
-
memory/2224-271-0x0000000000000000-mapping.dmp
-
memory/2228-241-0x0000000000000000-mapping.dmp
-
memory/2228-129-0x0000000000000000-mapping.dmp
-
memory/2232-272-0x0000000000000000-mapping.dmp
-
memory/2236-174-0x0000000000000000-mapping.dmp
-
memory/2244-130-0x0000000000000000-mapping.dmp
-
memory/2248-329-0x0000000000000000-mapping.dmp
-
memory/2248-372-0x0000000000000000-mapping.dmp
-
memory/2252-175-0x0000000000000000-mapping.dmp
-
memory/2256-243-0x0000000000000000-mapping.dmp
-
memory/2260-269-0x0000000000000000-mapping.dmp
-
memory/2260-293-0x0000000000000000-mapping.dmp
-
memory/2268-368-0x0000000000000000-mapping.dmp
-
memory/2268-333-0x0000000000000000-mapping.dmp
-
memory/2272-131-0x0000000000000000-mapping.dmp
-
memory/2272-176-0x0000000000000000-mapping.dmp
-
memory/2280-294-0x0000000000000000-mapping.dmp
-
memory/2292-132-0x0000000000000000-mapping.dmp
-
memory/2296-178-0x0000000000000000-mapping.dmp
-
memory/2300-214-0x0000000000000000-mapping.dmp
-
memory/2304-383-0x0000000000000000-mapping.dmp
-
memory/2304-394-0x0000000000000000-mapping.dmp
-
memory/2304-345-0x0000000000000000-mapping.dmp
-
memory/2304-295-0x0000000000000000-mapping.dmp
-
memory/2308-344-0x0000000000000000-mapping.dmp
-
memory/2312-389-0x0000000000000000-mapping.dmp
-
memory/2312-392-0x0000000000000000-mapping.dmp
-
memory/2320-133-0x0000000000000000-mapping.dmp
-
memory/2324-213-0x0000000000000000-mapping.dmp
-
memory/2328-384-0x0000000000000000-mapping.dmp
-
memory/2328-177-0x0000000000000000-mapping.dmp
-
memory/2336-134-0x0000000000000000-mapping.dmp
-
memory/2352-331-0x0000000000000000-mapping.dmp
-
memory/2352-380-0x0000000000000000-mapping.dmp
-
memory/2352-315-0x0000000000000000-mapping.dmp
-
memory/2352-273-0x0000000000000000-mapping.dmp
-
memory/2356-346-0x0000000000000000-mapping.dmp
-
memory/2364-179-0x0000000000000000-mapping.dmp
-
memory/2364-135-0x0000000000000000-mapping.dmp
-
memory/2364-296-0x0000000000000000-mapping.dmp
-
memory/2368-244-0x0000000000000000-mapping.dmp
-
memory/2372-215-0x0000000000000000-mapping.dmp
-
memory/2372-314-0x0000000000000000-mapping.dmp
-
memory/2380-136-0x0000000000000000-mapping.dmp
-
memory/2388-180-0x0000000000000000-mapping.dmp
-
memory/2392-245-0x0000000000000000-mapping.dmp
-
memory/2392-356-0x0000000000000000-mapping.dmp
-
memory/2400-181-0x0000000000000000-mapping.dmp
-
memory/2400-334-0x0000000000000000-mapping.dmp
-
memory/2404-366-0x0000000000000000-mapping.dmp
-
memory/2404-357-0x0000000000000000-mapping.dmp
-
memory/2404-317-0x0000000000000000-mapping.dmp
-
memory/2408-137-0x0000000000000000-mapping.dmp
-
memory/2408-216-0x0000000000000000-mapping.dmp
-
memory/2412-246-0x0000000000000000-mapping.dmp
-
memory/2412-217-0x0000000000000000-mapping.dmp
-
memory/2424-138-0x0000000000000000-mapping.dmp
-
memory/2432-274-0x0000000000000000-mapping.dmp
-
memory/2436-348-0x0000000000000000-mapping.dmp
-
memory/2444-275-0x0000000000000000-mapping.dmp
-
memory/2444-298-0x0000000000000000-mapping.dmp
-
memory/2448-248-0x0000000000000000-mapping.dmp
-
memory/2452-139-0x0000000000000000-mapping.dmp
-
memory/2456-365-0x0000000000000000-mapping.dmp
-
memory/2460-182-0x0000000000000000-mapping.dmp
-
memory/2468-140-0x0000000000000000-mapping.dmp
-
memory/2476-183-0x0000000000000000-mapping.dmp
-
memory/2480-219-0x0000000000000000-mapping.dmp
-
memory/2480-297-0x0000000000000000-mapping.dmp
-
memory/2480-316-0x0000000000000000-mapping.dmp
-
memory/2484-218-0x0000000000000000-mapping.dmp
-
memory/2492-251-0x0000000000000000-mapping.dmp
-
memory/2492-278-0x0000000000000000-mapping.dmp
-
memory/2496-184-0x0000000000000000-mapping.dmp
-
memory/2496-141-0x0000000000000000-mapping.dmp
-
memory/2512-142-0x0000000000000000-mapping.dmp
-
memory/2520-358-0x0000000000000000-mapping.dmp
-
memory/2520-301-0x0000000000000000-mapping.dmp
-
memory/2524-277-0x0000000000000000-mapping.dmp
-
memory/2528-220-0x0000000000000000-mapping.dmp
-
memory/2532-335-0x0000000000000000-mapping.dmp
-
memory/2536-186-0x0000000000000000-mapping.dmp
-
memory/2540-143-0x0000000000000000-mapping.dmp
-
memory/2544-247-0x0000000000000000-mapping.dmp
-
memory/2548-185-0x0000000000000000-mapping.dmp
-
memory/2556-144-0x0000000000000000-mapping.dmp
-
memory/2564-253-0x0000000000000000-mapping.dmp
-
memory/2564-379-0x0000000000000000-mapping.dmp
-
memory/2568-188-0x0000000000000000-mapping.dmp
-
memory/2580-319-0x0000000000000000-mapping.dmp
-
memory/2580-221-0x0000000000000000-mapping.dmp
-
memory/2580-347-0x0000000000000000-mapping.dmp
-
memory/2584-145-0x0000000000000000-mapping.dmp
-
memory/2584-299-0x0000000000000000-mapping.dmp
-
memory/2584-318-0x0000000000000000-mapping.dmp
-
memory/2584-187-0x0000000000000000-mapping.dmp
-
memory/2592-222-0x0000000000000000-mapping.dmp
-
memory/2600-146-0x0000000000000000-mapping.dmp
-
memory/2604-189-0x0000000000000000-mapping.dmp
-
memory/2608-401-0x0000000000000000-mapping.dmp
-
memory/2608-375-0x0000000000000000-mapping.dmp
-
memory/2612-320-0x0000000000000000-mapping.dmp
-
memory/2616-280-0x0000000000000000-mapping.dmp
-
memory/2620-223-0x0000000000000000-mapping.dmp
-
memory/2628-147-0x0000000000000000-mapping.dmp
-
memory/2632-360-0x0000000000000000-mapping.dmp
-
memory/2632-279-0x0000000000000000-mapping.dmp
-
memory/2644-148-0x0000000000000000-mapping.dmp
-
memory/2656-336-0x0000000000000000-mapping.dmp
-
memory/2656-191-0x0000000000000000-mapping.dmp
-
memory/2660-190-0x0000000000000000-mapping.dmp
-
memory/2664-302-0x0000000000000000-mapping.dmp
-
memory/2664-225-0x0000000000000000-mapping.dmp
-
memory/2668-376-0x0000000000000000-mapping.dmp
-
memory/2672-149-0x0000000000000000-mapping.dmp
-
memory/2672-282-0x0000000000000000-mapping.dmp
-
memory/2676-224-0x0000000000000000-mapping.dmp
-
memory/2680-322-0x0000000000000000-mapping.dmp
-
memory/2680-281-0x0000000000000000-mapping.dmp
-
memory/2680-255-0x0000000000000000-mapping.dmp
-
memory/2688-150-0x0000000000000000-mapping.dmp
-
memory/2696-254-0x0000000000000000-mapping.dmp
-
memory/2716-151-0x0000000000000000-mapping.dmp
-
memory/2716-303-0x0000000000000000-mapping.dmp
-
memory/2716-321-0x0000000000000000-mapping.dmp
-
memory/2720-304-0x0000000000000000-mapping.dmp
-
memory/2724-192-0x0000000000000000-mapping.dmp
-
memory/2732-152-0x0000000000000000-mapping.dmp
-
memory/2736-284-0x0000000000000000-mapping.dmp
-
memory/2740-350-0x0000000000000000-mapping.dmp
-
memory/2740-193-0x0000000000000000-mapping.dmp
-
memory/2744-227-0x0000000000000000-mapping.dmp
-
memory/2748-226-0x0000000000000000-mapping.dmp
-
memory/2756-382-0x0000000000000000-mapping.dmp
-
memory/2760-153-0x0000000000000000-mapping.dmp
-
memory/2760-194-0x0000000000000000-mapping.dmp
-
memory/2776-154-0x0000000000000000-mapping.dmp
-
memory/2780-196-0x0000000000000000-mapping.dmp
-
memory/2784-228-0x0000000000000000-mapping.dmp
-
memory/2788-337-0x0000000000000000-mapping.dmp
-
memory/2788-359-0x0000000000000000-mapping.dmp
-
memory/2792-338-0x0000000000000000-mapping.dmp
-
memory/2792-257-0x0000000000000000-mapping.dmp
-
memory/2792-283-0x0000000000000000-mapping.dmp
-
memory/2792-323-0x0000000000000000-mapping.dmp
-
memory/2804-155-0x0000000000000000-mapping.dmp
-
memory/2808-256-0x0000000000000000-mapping.dmp
-
memory/2812-195-0x0000000000000000-mapping.dmp
-
memory/2820-156-0x0000000000000000-mapping.dmp
-
memory/2828-349-0x0000000000000000-mapping.dmp
-
memory/2836-230-0x0000000000000000-mapping.dmp
-
memory/2840-198-0x0000000000000000-mapping.dmp
-
memory/2844-285-0x0000000000000000-mapping.dmp
-
memory/2848-258-0x0000000000000000-mapping.dmp
-
memory/2848-157-0x0000000000000000-mapping.dmp
-
memory/2848-229-0x0000000000000000-mapping.dmp
-
memory/2852-197-0x0000000000000000-mapping.dmp
-
memory/2856-367-0x0000000000000000-mapping.dmp
-
memory/2856-374-0x0000000000000000-mapping.dmp
-
memory/2864-158-0x0000000000000000-mapping.dmp
-
memory/2868-308-0x0000000000000000-mapping.dmp
-
memory/2868-199-0x0000000000000000-mapping.dmp
-
memory/2872-306-0x0000000000000000-mapping.dmp
-
memory/2892-231-0x0000000000000000-mapping.dmp
-
memory/2892-159-0x0000000000000000-mapping.dmp
-
memory/2896-324-0x0000000000000000-mapping.dmp
-
memory/2896-259-0x0000000000000000-mapping.dmp
-
memory/2908-160-0x0000000000000000-mapping.dmp
-
memory/2912-400-0x0000000000000000-mapping.dmp
-
memory/2912-391-0x0000000000000000-mapping.dmp
-
memory/2912-233-0x0000000000000000-mapping.dmp
-
memory/2912-307-0x0000000000000000-mapping.dmp
-
memory/2916-200-0x0000000000000000-mapping.dmp
-
memory/2920-201-0x0000000000000000-mapping.dmp
-
memory/2936-310-0x0000000000000000-mapping.dmp
-
memory/2936-161-0x0000000000000000-mapping.dmp
-
memory/2940-232-0x0000000000000000-mapping.dmp
-
memory/2944-343-0x0000000000000000-mapping.dmp
-
memory/2944-378-0x0000000000000000-mapping.dmp
-
memory/2952-162-0x0000000000000000-mapping.dmp
-
memory/2956-262-0x0000000000000000-mapping.dmp
-
memory/2964-290-0x0000000000000000-mapping.dmp
-
memory/2968-370-0x0000000000000000-mapping.dmp
-
memory/2968-325-0x0000000000000000-mapping.dmp
-
memory/2972-362-0x0000000000000000-mapping.dmp
-
memory/2980-163-0x0000000000000000-mapping.dmp
-
memory/2984-202-0x0000000000000000-mapping.dmp
-
memory/2996-164-0x0000000000000000-mapping.dmp
-
memory/3000-398-0x0000000000000000-mapping.dmp
-
memory/3000-371-0x0000000000000000-mapping.dmp
-
memory/3000-387-0x0000000000000000-mapping.dmp
-
memory/3000-341-0x0000000000000000-mapping.dmp
-
memory/3000-327-0x0000000000000000-mapping.dmp
-
memory/3000-377-0x0000000000000000-mapping.dmp
-
memory/3004-309-0x0000000000000000-mapping.dmp
-
memory/3004-397-0x0000000000000000-mapping.dmp
-
memory/3004-289-0x0000000000000000-mapping.dmp
-
memory/3008-265-0x0000000000000000-mapping.dmp
-
memory/3012-288-0x0000000000000000-mapping.dmp
-
memory/3012-203-0x0000000000000000-mapping.dmp
-
memory/3016-235-0x0000000000000000-mapping.dmp
-
memory/3020-204-0x0000000000000000-mapping.dmp
-
memory/3024-165-0x0000000000000000-mapping.dmp
-
memory/3028-234-0x0000000000000000-mapping.dmp
-
memory/3040-166-0x0000000000000000-mapping.dmp
-
memory/3048-264-0x0000000000000000-mapping.dmp
-
memory/3052-238-0x0000000000000000-mapping.dmp
-
memory/3056-312-0x0000000000000000-mapping.dmp
-
memory/3064-206-0x0000000000000000-mapping.dmp
-
memory/3068-167-0x0000000000000000-mapping.dmp
-
memory/3076-448-0x0000000000000000-mapping.dmp
-
memory/3088-402-0x0000000000000000-mapping.dmp
-
memory/3092-450-0x0000000000000000-mapping.dmp
-
memory/3104-449-0x0000000000000000-mapping.dmp
-
memory/3116-403-0x0000000000000000-mapping.dmp
-
memory/3132-404-0x0000000000000000-mapping.dmp
-
memory/3144-452-0x0000000000000000-mapping.dmp
-
memory/3160-405-0x0000000000000000-mapping.dmp
-
memory/3160-451-0x0000000000000000-mapping.dmp
-
memory/3176-406-0x0000000000000000-mapping.dmp
-
memory/3204-407-0x0000000000000000-mapping.dmp
-
memory/3204-453-0x0000000000000000-mapping.dmp
-
memory/3220-408-0x0000000000000000-mapping.dmp
-
memory/3244-455-0x0000000000000000-mapping.dmp
-
memory/3248-409-0x0000000000000000-mapping.dmp
-
memory/3264-410-0x0000000000000000-mapping.dmp
-
memory/3288-457-0x0000000000000000-mapping.dmp
-
memory/3292-411-0x0000000000000000-mapping.dmp
-
memory/3308-412-0x0000000000000000-mapping.dmp
-
memory/3316-458-0x0000000000000000-mapping.dmp
-
memory/3328-459-0x0000000000000000-mapping.dmp
-
memory/3336-413-0x0000000000000000-mapping.dmp
-
memory/3352-414-0x0000000000000000-mapping.dmp
-
memory/3380-415-0x0000000000000000-mapping.dmp
-
memory/3388-460-0x0000000000000000-mapping.dmp
-
memory/3396-416-0x0000000000000000-mapping.dmp
-
memory/3404-461-0x0000000000000000-mapping.dmp
-
memory/3424-417-0x0000000000000000-mapping.dmp
-
memory/3440-418-0x0000000000000000-mapping.dmp
-
memory/3468-419-0x0000000000000000-mapping.dmp
-
memory/3484-420-0x0000000000000000-mapping.dmp
-
memory/3512-421-0x0000000000000000-mapping.dmp
-
memory/3528-422-0x0000000000000000-mapping.dmp
-
memory/3556-423-0x0000000000000000-mapping.dmp
-
memory/3572-424-0x0000000000000000-mapping.dmp
-
memory/3600-425-0x0000000000000000-mapping.dmp
-
memory/3616-426-0x0000000000000000-mapping.dmp
-
memory/3644-427-0x0000000000000000-mapping.dmp
-
memory/3660-428-0x0000000000000000-mapping.dmp
-
memory/3688-429-0x0000000000000000-mapping.dmp
-
memory/3704-430-0x0000000000000000-mapping.dmp
-
memory/3732-431-0x0000000000000000-mapping.dmp
-
memory/3748-432-0x0000000000000000-mapping.dmp
-
memory/3776-433-0x0000000000000000-mapping.dmp
-
memory/3792-434-0x0000000000000000-mapping.dmp
-
memory/3820-435-0x0000000000000000-mapping.dmp
-
memory/3836-436-0x0000000000000000-mapping.dmp
-
memory/3864-437-0x0000000000000000-mapping.dmp
-
memory/3880-438-0x0000000000000000-mapping.dmp
-
memory/3908-439-0x0000000000000000-mapping.dmp
-
memory/3924-440-0x0000000000000000-mapping.dmp
-
memory/3952-441-0x0000000000000000-mapping.dmp
-
memory/3968-442-0x0000000000000000-mapping.dmp
-
memory/3996-443-0x0000000000000000-mapping.dmp
-
memory/4012-444-0x0000000000000000-mapping.dmp
-
memory/4040-445-0x0000000000000000-mapping.dmp
-
memory/4056-446-0x0000000000000000-mapping.dmp
-
memory/4084-447-0x0000000000000000-mapping.dmp