Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
04-12-2020 18:27
Static task
static1
Behavioral task
behavioral1
Sample
PAYMENT COPY.exe
Resource
win7v20201028
General
-
Target
PAYMENT COPY.exe
-
Size
585KB
-
MD5
7f038b33a43afc2d9687337f963e8ab5
-
SHA1
bfde3d1da7ae9f63050bb48d71433f3e112ad87e
-
SHA256
8a1531470b71afbae59477a8ba23f4f0c72895700676fd3b5371a2e7f9637b86
-
SHA512
52afc34a279f83e5b91989d8ec07d3ac5f71c46ee13e344e8e4d9c73e565596ed91d9a539266a4230318b282146da5e11dc26649bf01809977ec66c5b7405810
Malware Config
Extracted
nanocore
1.2.2.0
e12345.ddns.net:9034
79.134.225.22:9034
b92fa5b2-56be-4ad1-a2f0-1fdcc67d7c0b
-
activate_away_mode
false
-
backup_connection_host
79.134.225.22
- backup_dns_server
-
buffer_size
65538
-
build_time
2020-09-03T11:34:59.807683136Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
false
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
9034
-
default_group
TODAY2020
-
enable_debug_mode
true
-
gc_threshold
1.0485772e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.0485772e+07
-
mutex
b92fa5b2-56be-4ad1-a2f0-1fdcc67d7c0b
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
e12345.ddns.net
- primary_dns_server
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
false
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8009
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
qcxza.exepid process 3256 qcxza.exe -
Adds Run key to start application 2 TTPs 489 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\qcxza = "C:\\Users\\Admin\\Pictures\\qcxza.exe" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\qcxza = "C:\\Users\\Admin\\Pictures\\qcxza.exe" reg.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\qcxza = "C:\\Users\\Admin\\Pictures\\qcxza.exe" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\qcxza = "C:\\Users\\Admin\\Pictures\\qcxza.exe" reg.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\qcxza = "C:\\Users\\Admin\\Pictures\\qcxza.exe" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\qcxza = "C:\\Users\\Admin\\Pictures\\qcxza.exe" reg.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\qcxza = "C:\\Users\\Admin\\Pictures\\qcxza.exe" reg.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\qcxza = "C:\\Users\\Admin\\Pictures\\qcxza.exe" reg.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\qcxza = "C:\\Users\\Admin\\Pictures\\qcxza.exe" reg.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\qcxza = "C:\\Users\\Admin\\Pictures\\qcxza.exe" reg.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\qcxza = "C:\\Users\\Admin\\Pictures\\qcxza.exe" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\qcxza = "C:\\Users\\Admin\\Pictures\\qcxza.exe" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\qcxza = "C:\\Users\\Admin\\Pictures\\qcxza.exe" reg.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\qcxza = "C:\\Users\\Admin\\Pictures\\qcxza.exe" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\qcxza = "C:\\Users\\Admin\\Pictures\\qcxza.exe" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\qcxza = "C:\\Users\\Admin\\Pictures\\qcxza.exe" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\qcxza = "C:\\Users\\Admin\\Pictures\\qcxza.exe" reg.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\qcxza = "C:\\Users\\Admin\\Pictures\\qcxza.exe" reg.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\qcxza = "C:\\Users\\Admin\\Pictures\\qcxza.exe" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\qcxza = "C:\\Users\\Admin\\Pictures\\qcxza.exe" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\qcxza = "C:\\Users\\Admin\\Pictures\\qcxza.exe" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\qcxza = "C:\\Users\\Admin\\Pictures\\qcxza.exe" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\qcxza = "C:\\Users\\Admin\\Pictures\\qcxza.exe" reg.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\qcxza = "C:\\Users\\Admin\\Pictures\\qcxza.exe" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\qcxza = "C:\\Users\\Admin\\Pictures\\qcxza.exe" reg.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\qcxza = "C:\\Users\\Admin\\Pictures\\qcxza.exe" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\qcxza = "C:\\Users\\Admin\\Pictures\\qcxza.exe" reg.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\qcxza = "C:\\Users\\Admin\\Pictures\\qcxza.exe" reg.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\qcxza = "C:\\Users\\Admin\\Pictures\\qcxza.exe" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\qcxza = "C:\\Users\\Admin\\Pictures\\qcxza.exe" reg.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\qcxza = "C:\\Users\\Admin\\Pictures\\qcxza.exe" reg.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
qcxza.exedescription pid process target process PID 3256 set thread context of 4496 3256 qcxza.exe InstallUtil.exe -
Drops file in Program Files directory 2 IoCs
Processes:
InstallUtil.exedescription ioc process File created C:\Program Files (x86)\WAN Service\wansv.exe InstallUtil.exe File opened for modification C:\Program Files (x86)\WAN Service\wansv.exe InstallUtil.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 1776 schtasks.exe 1828 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
qcxza.exeInstallUtil.exepid process 3256 qcxza.exe 3256 qcxza.exe 4496 InstallUtil.exe 4496 InstallUtil.exe 4496 InstallUtil.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
Processes:
InstallUtil.exeqcxza.exepid process 4496 InstallUtil.exe 3256 qcxza.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
PAYMENT COPY.exeqcxza.exeInstallUtil.exedescription pid process Token: SeDebugPrivilege 4768 PAYMENT COPY.exe Token: SeDebugPrivilege 3256 qcxza.exe Token: SeDebugPrivilege 4496 InstallUtil.exe Token: SeDebugPrivilege 4496 InstallUtil.exe -
Suspicious use of WriteProcessMemory 1487 IoCs
Processes:
PAYMENT COPY.execmd.exeqcxza.execmd.execmd.execmd.execmd.execmd.exeInstallUtil.execmd.execmd.exedescription pid process target process PID 4768 wrote to memory of 4280 4768 PAYMENT COPY.exe cmd.exe PID 4768 wrote to memory of 4280 4768 PAYMENT COPY.exe cmd.exe PID 4768 wrote to memory of 4280 4768 PAYMENT COPY.exe cmd.exe PID 4768 wrote to memory of 752 4768 PAYMENT COPY.exe cmd.exe PID 4768 wrote to memory of 752 4768 PAYMENT COPY.exe cmd.exe PID 4768 wrote to memory of 752 4768 PAYMENT COPY.exe cmd.exe PID 752 wrote to memory of 3256 752 cmd.exe qcxza.exe PID 752 wrote to memory of 3256 752 cmd.exe qcxza.exe PID 752 wrote to memory of 3256 752 cmd.exe qcxza.exe PID 3256 wrote to memory of 4052 3256 qcxza.exe cmd.exe PID 3256 wrote to memory of 4052 3256 qcxza.exe cmd.exe PID 3256 wrote to memory of 4052 3256 qcxza.exe cmd.exe PID 4052 wrote to memory of 4044 4052 cmd.exe reg.exe PID 4052 wrote to memory of 4044 4052 cmd.exe reg.exe PID 4052 wrote to memory of 4044 4052 cmd.exe reg.exe PID 3256 wrote to memory of 4532 3256 qcxza.exe cmd.exe PID 3256 wrote to memory of 4532 3256 qcxza.exe cmd.exe PID 3256 wrote to memory of 4532 3256 qcxza.exe cmd.exe PID 3256 wrote to memory of 4496 3256 qcxza.exe InstallUtil.exe PID 3256 wrote to memory of 4496 3256 qcxza.exe InstallUtil.exe PID 3256 wrote to memory of 4496 3256 qcxza.exe InstallUtil.exe PID 4532 wrote to memory of 4584 4532 cmd.exe reg.exe PID 4532 wrote to memory of 4584 4532 cmd.exe reg.exe PID 4532 wrote to memory of 4584 4532 cmd.exe reg.exe PID 3256 wrote to memory of 4496 3256 qcxza.exe InstallUtil.exe PID 3256 wrote to memory of 4496 3256 qcxza.exe InstallUtil.exe PID 3256 wrote to memory of 4496 3256 qcxza.exe InstallUtil.exe PID 3256 wrote to memory of 4496 3256 qcxza.exe InstallUtil.exe PID 3256 wrote to memory of 4496 3256 qcxza.exe InstallUtil.exe PID 3256 wrote to memory of 4576 3256 qcxza.exe cmd.exe PID 3256 wrote to memory of 4576 3256 qcxza.exe cmd.exe PID 3256 wrote to memory of 4576 3256 qcxza.exe cmd.exe PID 4576 wrote to memory of 592 4576 cmd.exe reg.exe PID 4576 wrote to memory of 592 4576 cmd.exe reg.exe PID 4576 wrote to memory of 592 4576 cmd.exe reg.exe PID 3256 wrote to memory of 68 3256 qcxza.exe cmd.exe PID 3256 wrote to memory of 68 3256 qcxza.exe cmd.exe PID 3256 wrote to memory of 68 3256 qcxza.exe cmd.exe PID 68 wrote to memory of 1260 68 cmd.exe reg.exe PID 68 wrote to memory of 1260 68 cmd.exe reg.exe PID 68 wrote to memory of 1260 68 cmd.exe reg.exe PID 3256 wrote to memory of 1388 3256 qcxza.exe cmd.exe PID 3256 wrote to memory of 1388 3256 qcxza.exe cmd.exe PID 3256 wrote to memory of 1388 3256 qcxza.exe cmd.exe PID 1388 wrote to memory of 1524 1388 cmd.exe reg.exe PID 1388 wrote to memory of 1524 1388 cmd.exe reg.exe PID 1388 wrote to memory of 1524 1388 cmd.exe reg.exe PID 4496 wrote to memory of 1776 4496 InstallUtil.exe schtasks.exe PID 4496 wrote to memory of 1776 4496 InstallUtil.exe schtasks.exe PID 4496 wrote to memory of 1776 4496 InstallUtil.exe schtasks.exe PID 4496 wrote to memory of 1828 4496 InstallUtil.exe schtasks.exe PID 4496 wrote to memory of 1828 4496 InstallUtil.exe schtasks.exe PID 4496 wrote to memory of 1828 4496 InstallUtil.exe schtasks.exe PID 3256 wrote to memory of 2588 3256 qcxza.exe cmd.exe PID 3256 wrote to memory of 2588 3256 qcxza.exe cmd.exe PID 3256 wrote to memory of 2588 3256 qcxza.exe cmd.exe PID 2588 wrote to memory of 4716 2588 cmd.exe reg.exe PID 2588 wrote to memory of 4716 2588 cmd.exe reg.exe PID 2588 wrote to memory of 4716 2588 cmd.exe reg.exe PID 3256 wrote to memory of 4400 3256 qcxza.exe cmd.exe PID 3256 wrote to memory of 4400 3256 qcxza.exe cmd.exe PID 3256 wrote to memory of 4400 3256 qcxza.exe cmd.exe PID 4400 wrote to memory of 212 4400 cmd.exe reg.exe PID 4400 wrote to memory of 212 4400 cmd.exe reg.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PAYMENT COPY.exe"C:\Users\Admin\AppData\Local\Temp\PAYMENT COPY.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\PAYMENT COPY.exe" "C:\Users\Admin\Pictures\qcxza.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c, "C:\Users\Admin\Pictures\qcxza.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Pictures\qcxza.exe"C:\Users\Admin\Pictures\qcxza.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"4⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "WAN Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmp3D6C.tmp"5⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "WAN Service Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp3DBB.tmp"5⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "qcxza" /t REG_SZ /d "C:\Users\Admin\Pictures\qcxza.exe"5⤵
- Adds Run key to start application
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp3D6C.tmpMD5
576bbaf398045c3843d452ec83208236
SHA18ed5b2500ae7a40cbfa6e9018a1d1f1e70cb1374
SHA25633c0c2d72fa383e5988ce640febc5ac6a2bd71d4ae660b99e52234952e17467b
SHA512e7cc0ea0b351c6a8618e14f03c00e88ef83e2f169e0b4d66513f580f0a9352fbfe429e57186362b69407150d566bbdadca2f7b574fc748cc140b3249be67f96a
-
C:\Users\Admin\AppData\Local\Temp\tmp3DBB.tmpMD5
eb527779d4a920bac8c3c59e8f4b4b4c
SHA14c9c48fd4ab89a983c87d810577133dc281160b4
SHA25697a200adfccc855ed435941fe1453a6add1a66b8390d033279c2f1a6a64c26a2
SHA512a48c1ca2310a4bceacca90d3b8748fdecc0169738905e0bc62a665ab048c1ae6bb801dc99f0f04d85287993c27bfd0a4e7f59d27a1c233b6662d6ba3ca586da0
-
C:\Users\Admin\Pictures\qcxza.exeMD5
7f038b33a43afc2d9687337f963e8ab5
SHA1bfde3d1da7ae9f63050bb48d71433f3e112ad87e
SHA2568a1531470b71afbae59477a8ba23f4f0c72895700676fd3b5371a2e7f9637b86
SHA51252afc34a279f83e5b91989d8ec07d3ac5f71c46ee13e344e8e4d9c73e565596ed91d9a539266a4230318b282146da5e11dc26649bf01809977ec66c5b7405810
-
C:\Users\Admin\Pictures\qcxza.exeMD5
7f038b33a43afc2d9687337f963e8ab5
SHA1bfde3d1da7ae9f63050bb48d71433f3e112ad87e
SHA2568a1531470b71afbae59477a8ba23f4f0c72895700676fd3b5371a2e7f9637b86
SHA51252afc34a279f83e5b91989d8ec07d3ac5f71c46ee13e344e8e4d9c73e565596ed91d9a539266a4230318b282146da5e11dc26649bf01809977ec66c5b7405810
-
memory/8-312-0x0000000000000000-mapping.dmp
-
memory/68-34-0x0000000000000000-mapping.dmp
-
memory/188-230-0x0000000000000000-mapping.dmp
-
memory/192-124-0x0000000000000000-mapping.dmp
-
memory/208-290-0x0000000000000000-mapping.dmp
-
memory/212-55-0x0000000000000000-mapping.dmp
-
memory/220-121-0x0000000000000000-mapping.dmp
-
memory/236-177-0x0000000000000000-mapping.dmp
-
memory/380-262-0x0000000000000000-mapping.dmp
-
memory/384-210-0x0000000000000000-mapping.dmp
-
memory/436-114-0x0000000000000000-mapping.dmp
-
memory/440-103-0x0000000000000000-mapping.dmp
-
memory/496-115-0x0000000000000000-mapping.dmp
-
memory/520-191-0x0000000000000000-mapping.dmp
-
memory/532-263-0x0000000000000000-mapping.dmp
-
memory/560-104-0x0000000000000000-mapping.dmp
-
memory/592-30-0x0000000000000000-mapping.dmp
-
memory/604-298-0x0000000000000000-mapping.dmp
-
memory/632-144-0x0000000000000000-mapping.dmp
-
memory/660-78-0x0000000000000000-mapping.dmp
-
memory/672-178-0x0000000000000000-mapping.dmp
-
memory/752-11-0x0000000000000000-mapping.dmp
-
memory/756-162-0x0000000000000000-mapping.dmp
-
memory/808-105-0x0000000000000000-mapping.dmp
-
memory/820-79-0x0000000000000000-mapping.dmp
-
memory/824-113-0x0000000000000000-mapping.dmp
-
memory/828-237-0x0000000000000000-mapping.dmp
-
memory/880-311-0x0000000000000000-mapping.dmp
-
memory/932-299-0x0000000000000000-mapping.dmp
-
memory/968-151-0x0000000000000000-mapping.dmp
-
memory/1020-314-0x0000000000000000-mapping.dmp
-
memory/1028-193-0x0000000000000000-mapping.dmp
-
memory/1096-250-0x0000000000000000-mapping.dmp
-
memory/1104-81-0x0000000000000000-mapping.dmp
-
memory/1136-288-0x0000000000000000-mapping.dmp
-
memory/1144-225-0x0000000000000000-mapping.dmp
-
memory/1152-307-0x0000000000000000-mapping.dmp
-
memory/1160-253-0x0000000000000000-mapping.dmp
-
memory/1180-80-0x0000000000000000-mapping.dmp
-
memory/1184-192-0x0000000000000000-mapping.dmp
-
memory/1240-226-0x0000000000000000-mapping.dmp
-
memory/1256-373-0x0000000000000000-mapping.dmp
-
memory/1260-40-0x0000000000000000-mapping.dmp
-
memory/1272-145-0x0000000000000000-mapping.dmp
-
memory/1288-171-0x0000000000000000-mapping.dmp
-
memory/1364-56-0x0000000000000000-mapping.dmp
-
memory/1376-126-0x0000000000000000-mapping.dmp
-
memory/1384-156-0x0000000000000000-mapping.dmp
-
memory/1388-42-0x0000000000000000-mapping.dmp
-
memory/1392-82-0x0000000000000000-mapping.dmp
-
memory/1396-96-0x0000000000000000-mapping.dmp
-
memory/1404-173-0x0000000000000000-mapping.dmp
-
memory/1408-172-0x0000000000000000-mapping.dmp
-
memory/1432-238-0x0000000000000000-mapping.dmp
-
memory/1436-273-0x0000000000000000-mapping.dmp
-
memory/1448-228-0x0000000000000000-mapping.dmp
-
memory/1456-293-0x0000000000000000-mapping.dmp
-
memory/1464-252-0x0000000000000000-mapping.dmp
-
memory/1468-456-0x0000000000000000-mapping.dmp
-
memory/1500-394-0x0000000000000000-mapping.dmp
-
memory/1504-83-0x0000000000000000-mapping.dmp
-
memory/1524-43-0x0000000000000000-mapping.dmp
-
memory/1548-148-0x0000000000000000-mapping.dmp
-
memory/1584-176-0x0000000000000000-mapping.dmp
-
memory/1616-65-0x0000000000000000-mapping.dmp
-
memory/1620-251-0x0000000000000000-mapping.dmp
-
memory/1668-309-0x0000000000000000-mapping.dmp
-
memory/1676-117-0x0000000000000000-mapping.dmp
-
memory/1684-116-0x0000000000000000-mapping.dmp
-
memory/1772-146-0x0000000000000000-mapping.dmp
-
memory/1776-44-0x0000000000000000-mapping.dmp
-
memory/1784-227-0x0000000000000000-mapping.dmp
-
memory/1828-46-0x0000000000000000-mapping.dmp
-
memory/1848-183-0x0000000000000000-mapping.dmp
-
memory/1876-283-0x0000000000000000-mapping.dmp
-
memory/1896-73-0x0000000000000000-mapping.dmp
-
memory/1952-304-0x0000000000000000-mapping.dmp
-
memory/1960-138-0x0000000000000000-mapping.dmp
-
memory/1964-84-0x0000000000000000-mapping.dmp
-
memory/2000-267-0x0000000000000000-mapping.dmp
-
memory/2128-213-0x0000000000000000-mapping.dmp
-
memory/2132-392-0x0000000000000000-mapping.dmp
-
memory/2156-118-0x0000000000000000-mapping.dmp
-
memory/2160-292-0x0000000000000000-mapping.dmp
-
memory/2164-274-0x0000000000000000-mapping.dmp
-
memory/2172-346-0x0000000000000000-mapping.dmp
-
memory/2176-284-0x0000000000000000-mapping.dmp
-
memory/2192-142-0x0000000000000000-mapping.dmp
-
memory/2204-277-0x0000000000000000-mapping.dmp
-
memory/2208-197-0x0000000000000000-mapping.dmp
-
memory/2216-310-0x0000000000000000-mapping.dmp
-
memory/2220-181-0x0000000000000000-mapping.dmp
-
memory/2228-189-0x0000000000000000-mapping.dmp
-
memory/2232-280-0x0000000000000000-mapping.dmp
-
memory/2236-261-0x0000000000000000-mapping.dmp
-
memory/2268-62-0x0000000000000000-mapping.dmp
-
memory/2296-58-0x0000000000000000-mapping.dmp
-
memory/2304-85-0x0000000000000000-mapping.dmp
-
memory/2308-266-0x0000000000000000-mapping.dmp
-
memory/2356-196-0x0000000000000000-mapping.dmp
-
memory/2496-239-0x0000000000000000-mapping.dmp
-
memory/2548-86-0x0000000000000000-mapping.dmp
-
memory/2560-242-0x0000000000000000-mapping.dmp
-
memory/2580-241-0x0000000000000000-mapping.dmp
-
memory/2588-52-0x0000000000000000-mapping.dmp
-
memory/2592-214-0x0000000000000000-mapping.dmp
-
memory/2600-174-0x0000000000000000-mapping.dmp
-
memory/2604-195-0x0000000000000000-mapping.dmp
-
memory/2608-88-0x0000000000000000-mapping.dmp
-
memory/2628-101-0x0000000000000000-mapping.dmp
-
memory/2644-221-0x0000000000000000-mapping.dmp
-
memory/2672-231-0x0000000000000000-mapping.dmp
-
memory/2684-154-0x0000000000000000-mapping.dmp
-
memory/2696-89-0x0000000000000000-mapping.dmp
-
memory/2716-254-0x0000000000000000-mapping.dmp
-
memory/2728-276-0x0000000000000000-mapping.dmp
-
memory/2756-285-0x0000000000000000-mapping.dmp
-
memory/2836-302-0x0000000000000000-mapping.dmp
-
memory/2856-87-0x0000000000000000-mapping.dmp
-
memory/2864-119-0x0000000000000000-mapping.dmp
-
memory/2888-198-0x0000000000000000-mapping.dmp
-
memory/2904-255-0x0000000000000000-mapping.dmp
-
memory/2912-229-0x0000000000000000-mapping.dmp
-
memory/2936-313-0x0000000000000000-mapping.dmp
-
memory/2940-462-0x0000000000000000-mapping.dmp
-
memory/2980-481-0x0000000000000000-mapping.dmp
-
memory/3004-315-0x0000000000000000-mapping.dmp
-
memory/3012-61-0x0000000000000000-mapping.dmp
-
memory/3032-297-0x0000000000000000-mapping.dmp
-
memory/3080-175-0x0000000000000000-mapping.dmp
-
memory/3084-212-0x0000000000000000-mapping.dmp
-
memory/3088-287-0x0000000000000000-mapping.dmp
-
memory/3092-180-0x0000000000000000-mapping.dmp
-
memory/3108-204-0x0000000000000000-mapping.dmp
-
memory/3116-257-0x0000000000000000-mapping.dmp
-
memory/3132-97-0x0000000000000000-mapping.dmp
-
memory/3148-286-0x0000000000000000-mapping.dmp
-
memory/3164-486-0x0000000000000000-mapping.dmp
-
memory/3172-147-0x0000000000000000-mapping.dmp
-
memory/3196-295-0x0000000000000000-mapping.dmp
-
memory/3256-12-0x0000000000000000-mapping.dmp
-
memory/3256-15-0x0000000073370000-0x0000000073A5E000-memory.dmpFilesize
6.9MB
-
memory/3256-25-0x0000000009850000-0x000000000985A000-memory.dmpFilesize
40KB
-
memory/3256-27-0x0000000009770000-0x0000000009771000-memory.dmpFilesize
4KB
-
memory/3340-301-0x0000000000000000-mapping.dmp
-
memory/3372-383-0x0000000000000000-mapping.dmp
-
memory/3392-201-0x0000000000000000-mapping.dmp
-
memory/3428-179-0x0000000000000000-mapping.dmp
-
memory/3432-271-0x0000000000000000-mapping.dmp
-
memory/3452-110-0x0000000000000000-mapping.dmp
-
memory/3472-132-0x0000000000000000-mapping.dmp
-
memory/3488-247-0x0000000000000000-mapping.dmp
-
memory/3560-211-0x0000000000000000-mapping.dmp
-
memory/3564-236-0x0000000000000000-mapping.dmp
-
memory/3572-93-0x0000000000000000-mapping.dmp
-
memory/3584-127-0x0000000000000000-mapping.dmp
-
memory/3612-134-0x0000000000000000-mapping.dmp
-
memory/3616-200-0x0000000000000000-mapping.dmp
-
memory/3620-66-0x0000000000000000-mapping.dmp
-
memory/3628-232-0x0000000000000000-mapping.dmp
-
memory/3656-94-0x0000000000000000-mapping.dmp
-
memory/3660-265-0x0000000000000000-mapping.dmp
-
memory/3664-123-0x0000000000000000-mapping.dmp
-
memory/3732-74-0x0000000000000000-mapping.dmp
-
memory/3820-72-0x0000000000000000-mapping.dmp
-
memory/3824-106-0x0000000000000000-mapping.dmp
-
memory/3880-75-0x0000000000000000-mapping.dmp
-
memory/3888-240-0x0000000000000000-mapping.dmp
-
memory/3900-153-0x0000000000000000-mapping.dmp
-
memory/3904-218-0x0000000000000000-mapping.dmp
-
memory/3912-223-0x0000000000000000-mapping.dmp
-
memory/3920-64-0x0000000000000000-mapping.dmp
-
memory/3928-57-0x0000000000000000-mapping.dmp
-
memory/3952-90-0x0000000000000000-mapping.dmp
-
memory/3960-497-0x0000000000000000-mapping.dmp
-
memory/4008-487-0x0000000000000000-mapping.dmp
-
memory/4040-109-0x0000000000000000-mapping.dmp
-
memory/4044-24-0x0000000000000000-mapping.dmp
-
memory/4052-23-0x0000000000000000-mapping.dmp
-
memory/4064-494-0x0000000000000000-mapping.dmp
-
memory/4080-164-0x0000000000000000-mapping.dmp
-
memory/4088-137-0x0000000000000000-mapping.dmp
-
memory/4092-167-0x0000000000000000-mapping.dmp
-
memory/4100-306-0x0000000000000000-mapping.dmp
-
memory/4104-272-0x0000000000000000-mapping.dmp
-
memory/4108-100-0x0000000000000000-mapping.dmp
-
memory/4112-248-0x0000000000000000-mapping.dmp
-
memory/4132-182-0x0000000000000000-mapping.dmp
-
memory/4156-163-0x0000000000000000-mapping.dmp
-
memory/4176-190-0x0000000000000000-mapping.dmp
-
memory/4180-108-0x0000000000000000-mapping.dmp
-
memory/4188-205-0x0000000000000000-mapping.dmp
-
memory/4204-159-0x0000000000000000-mapping.dmp
-
memory/4212-233-0x0000000000000000-mapping.dmp
-
memory/4220-294-0x0000000000000000-mapping.dmp
-
memory/4224-185-0x0000000000000000-mapping.dmp
-
memory/4228-67-0x0000000000000000-mapping.dmp
-
memory/4240-203-0x0000000000000000-mapping.dmp
-
memory/4244-102-0x0000000000000000-mapping.dmp
-
memory/4248-249-0x0000000000000000-mapping.dmp
-
memory/4252-160-0x0000000000000000-mapping.dmp
-
memory/4256-71-0x0000000000000000-mapping.dmp
-
memory/4260-131-0x0000000000000000-mapping.dmp
-
memory/4264-220-0x0000000000000000-mapping.dmp
-
memory/4268-70-0x0000000000000000-mapping.dmp
-
memory/4280-10-0x0000000000000000-mapping.dmp
-
memory/4284-133-0x0000000000000000-mapping.dmp
-
memory/4292-68-0x0000000000000000-mapping.dmp
-
memory/4296-303-0x0000000000000000-mapping.dmp
-
memory/4300-259-0x0000000000000000-mapping.dmp
-
memory/4304-69-0x0000000000000000-mapping.dmp
-
memory/4320-157-0x0000000000000000-mapping.dmp
-
memory/4328-269-0x0000000000000000-mapping.dmp
-
memory/4336-216-0x0000000000000000-mapping.dmp
-
memory/4344-59-0x0000000000000000-mapping.dmp
-
memory/4356-60-0x0000000000000000-mapping.dmp
-
memory/4372-149-0x0000000000000000-mapping.dmp
-
memory/4376-128-0x0000000000000000-mapping.dmp
-
memory/4384-95-0x0000000000000000-mapping.dmp
-
memory/4400-54-0x0000000000000000-mapping.dmp
-
memory/4404-122-0x0000000000000000-mapping.dmp
-
memory/4412-245-0x0000000000000000-mapping.dmp
-
memory/4432-107-0x0000000000000000-mapping.dmp
-
memory/4440-291-0x0000000000000000-mapping.dmp
-
memory/4444-141-0x0000000000000000-mapping.dmp
-
memory/4456-92-0x0000000000000000-mapping.dmp
-
memory/4460-246-0x0000000000000000-mapping.dmp
-
memory/4476-222-0x0000000000000000-mapping.dmp
-
memory/4480-77-0x0000000000000000-mapping.dmp
-
memory/4496-51-0x0000000005150000-0x0000000005153000-memory.dmpFilesize
12KB
-
memory/4496-49-0x0000000004C40000-0x0000000004C46000-memory.dmpFilesize
24KB
-
memory/4496-33-0x0000000073370000-0x0000000073A5E000-memory.dmpFilesize
6.9MB
-
memory/4496-50-0x0000000004CE0000-0x0000000004CF9000-memory.dmpFilesize
100KB
-
memory/4496-35-0x0000000000370000-0x00000000003AA000-memory.dmpFilesize
232KB
-
memory/4496-41-0x00000000026B0000-0x00000000026B1000-memory.dmpFilesize
4KB
-
memory/4496-48-0x0000000004C20000-0x0000000004C25000-memory.dmpFilesize
20KB
-
memory/4496-32-0x000000000041E792-mapping.dmp
-
memory/4500-152-0x0000000000000000-mapping.dmp
-
memory/4504-282-0x0000000000000000-mapping.dmp
-
memory/4516-187-0x0000000000000000-mapping.dmp
-
memory/4520-208-0x0000000000000000-mapping.dmp
-
memory/4524-235-0x0000000000000000-mapping.dmp
-
memory/4532-26-0x0000000000000000-mapping.dmp
-
memory/4536-170-0x0000000000000000-mapping.dmp
-
memory/4548-112-0x0000000000000000-mapping.dmp
-
memory/4556-209-0x0000000000000000-mapping.dmp
-
memory/4560-207-0x0000000000000000-mapping.dmp
-
memory/4564-91-0x0000000000000000-mapping.dmp
-
memory/4572-111-0x0000000000000000-mapping.dmp
-
memory/4576-29-0x0000000000000000-mapping.dmp
-
memory/4580-169-0x0000000000000000-mapping.dmp
-
memory/4584-28-0x0000000000000000-mapping.dmp
-
memory/4588-76-0x0000000000000000-mapping.dmp
-
memory/4596-219-0x0000000000000000-mapping.dmp
-
memory/4600-168-0x0000000000000000-mapping.dmp
-
memory/4608-98-0x0000000000000000-mapping.dmp
-
memory/4620-143-0x0000000000000000-mapping.dmp
-
memory/4628-215-0x0000000000000000-mapping.dmp
-
memory/4648-129-0x0000000000000000-mapping.dmp
-
memory/4656-258-0x0000000000000000-mapping.dmp
-
memory/4660-224-0x0000000000000000-mapping.dmp
-
memory/4676-217-0x0000000000000000-mapping.dmp
-
memory/4680-268-0x0000000000000000-mapping.dmp
-
memory/4684-155-0x0000000000000000-mapping.dmp
-
memory/4688-296-0x0000000000000000-mapping.dmp
-
memory/4692-130-0x0000000000000000-mapping.dmp
-
memory/4696-202-0x0000000000000000-mapping.dmp
-
memory/4700-99-0x0000000000000000-mapping.dmp
-
memory/4704-125-0x0000000000000000-mapping.dmp
-
memory/4716-53-0x0000000000000000-mapping.dmp
-
memory/4732-275-0x0000000000000000-mapping.dmp
-
memory/4736-264-0x0000000000000000-mapping.dmp
-
memory/4748-194-0x0000000000000000-mapping.dmp
-
memory/4752-120-0x0000000000000000-mapping.dmp
-
memory/4768-5-0x0000000004990000-0x0000000004991000-memory.dmpFilesize
4KB
-
memory/4768-6-0x00000000023A0000-0x00000000023B7000-memory.dmpFilesize
92KB
-
memory/4768-7-0x00000000023E0000-0x00000000023FF000-memory.dmpFilesize
124KB
-
memory/4768-8-0x00000000076C0000-0x00000000076C1000-memory.dmpFilesize
4KB
-
memory/4768-2-0x0000000073370000-0x0000000073A5E000-memory.dmpFilesize
6.9MB
-
memory/4768-9-0x00000000072A0000-0x00000000072A1000-memory.dmpFilesize
4KB
-
memory/4768-3-0x00000000000C0000-0x00000000000C1000-memory.dmpFilesize
4KB
-
memory/4776-63-0x0000000000000000-mapping.dmp
-
memory/4788-243-0x0000000000000000-mapping.dmp
-
memory/4800-165-0x0000000000000000-mapping.dmp
-
memory/4812-158-0x0000000000000000-mapping.dmp
-
memory/4816-278-0x0000000000000000-mapping.dmp
-
memory/4820-308-0x0000000000000000-mapping.dmp
-
memory/4824-206-0x0000000000000000-mapping.dmp
-
memory/4836-490-0x0000000000000000-mapping.dmp
-
memory/4840-305-0x0000000000000000-mapping.dmp
-
memory/4844-234-0x0000000000000000-mapping.dmp
-
memory/4856-188-0x0000000000000000-mapping.dmp
-
memory/4860-184-0x0000000000000000-mapping.dmp
-
memory/4864-140-0x0000000000000000-mapping.dmp
-
memory/4868-199-0x0000000000000000-mapping.dmp
-
memory/4872-244-0x0000000000000000-mapping.dmp
-
memory/4884-139-0x0000000000000000-mapping.dmp
-
memory/4892-281-0x0000000000000000-mapping.dmp
-
memory/4896-161-0x0000000000000000-mapping.dmp
-
memory/4908-256-0x0000000000000000-mapping.dmp
-
memory/4916-135-0x0000000000000000-mapping.dmp
-
memory/4932-300-0x0000000000000000-mapping.dmp
-
memory/4940-279-0x0000000000000000-mapping.dmp
-
memory/4944-260-0x0000000000000000-mapping.dmp
-
memory/4980-270-0x0000000000000000-mapping.dmp
-
memory/5008-150-0x0000000000000000-mapping.dmp
-
memory/5024-493-0x0000000000000000-mapping.dmp
-
memory/5028-495-0x0000000000000000-mapping.dmp
-
memory/5044-136-0x0000000000000000-mapping.dmp
-
memory/5048-289-0x0000000000000000-mapping.dmp
-
memory/5052-166-0x0000000000000000-mapping.dmp
-
memory/5056-432-0x0000000000000000-mapping.dmp
-
memory/5076-186-0x0000000000000000-mapping.dmp
-
memory/5108-488-0x0000000000000000-mapping.dmp
-
memory/5124-435-0x0000000000000000-mapping.dmp
-
memory/5132-316-0x0000000000000000-mapping.dmp
-
memory/5136-348-0x0000000000000000-mapping.dmp
-
memory/5140-449-0x0000000000000000-mapping.dmp
-
memory/5148-426-0x0000000000000000-mapping.dmp
-
memory/5152-410-0x0000000000000000-mapping.dmp
-
memory/5164-427-0x0000000000000000-mapping.dmp
-
memory/5172-457-0x0000000000000000-mapping.dmp
-
memory/5176-317-0x0000000000000000-mapping.dmp
-
memory/5180-393-0x0000000000000000-mapping.dmp
-
memory/5184-347-0x0000000000000000-mapping.dmp
-
memory/5188-372-0x0000000000000000-mapping.dmp
-
memory/5200-318-0x0000000000000000-mapping.dmp
-
memory/5204-476-0x0000000000000000-mapping.dmp
-
memory/5212-438-0x0000000000000000-mapping.dmp
-
memory/5216-396-0x0000000000000000-mapping.dmp
-
memory/5220-376-0x0000000000000000-mapping.dmp
-
memory/5236-350-0x0000000000000000-mapping.dmp
-
memory/5240-374-0x0000000000000000-mapping.dmp
-
memory/5244-319-0x0000000000000000-mapping.dmp
-
memory/5248-349-0x0000000000000000-mapping.dmp
-
memory/5252-482-0x0000000000000000-mapping.dmp
-
memory/5260-440-0x0000000000000000-mapping.dmp
-
memory/5268-320-0x0000000000000000-mapping.dmp
-
memory/5272-437-0x0000000000000000-mapping.dmp
-
memory/5276-499-0x0000000000000000-mapping.dmp
-
memory/5284-469-0x0000000000000000-mapping.dmp
-
memory/5288-464-0x0000000000000000-mapping.dmp
-
memory/5292-375-0x0000000000000000-mapping.dmp
-
memory/5300-351-0x0000000000000000-mapping.dmp
-
memory/5304-412-0x0000000000000000-mapping.dmp
-
memory/5312-321-0x0000000000000000-mapping.dmp
-
memory/5316-413-0x0000000000000000-mapping.dmp
-
memory/5320-477-0x0000000000000000-mapping.dmp
-
memory/5324-395-0x0000000000000000-mapping.dmp
-
memory/5336-322-0x0000000000000000-mapping.dmp
-
memory/5340-378-0x0000000000000000-mapping.dmp
-
memory/5344-352-0x0000000000000000-mapping.dmp
-
memory/5348-398-0x0000000000000000-mapping.dmp
-
memory/5352-414-0x0000000000000000-mapping.dmp
-
memory/5356-377-0x0000000000000000-mapping.dmp
-
memory/5368-429-0x0000000000000000-mapping.dmp
-
memory/5372-353-0x0000000000000000-mapping.dmp
-
memory/5380-323-0x0000000000000000-mapping.dmp
-
memory/5384-399-0x0000000000000000-mapping.dmp
-
memory/5388-500-0x0000000000000000-mapping.dmp
-
memory/5392-397-0x0000000000000000-mapping.dmp
-
memory/5404-324-0x0000000000000000-mapping.dmp
-
memory/5408-468-0x0000000000000000-mapping.dmp
-
memory/5412-479-0x0000000000000000-mapping.dmp
-
memory/5416-439-0x0000000000000000-mapping.dmp
-
memory/5428-501-0x0000000000000000-mapping.dmp
-
memory/5440-379-0x0000000000000000-mapping.dmp
-
memory/5444-463-0x0000000000000000-mapping.dmp
-
memory/5448-325-0x0000000000000000-mapping.dmp
-
memory/5460-428-0x0000000000000000-mapping.dmp
-
memory/5464-354-0x0000000000000000-mapping.dmp
-
memory/5472-326-0x0000000000000000-mapping.dmp
-
memory/5476-496-0x0000000000000000-mapping.dmp
-
memory/5480-355-0x0000000000000000-mapping.dmp
-
memory/5484-430-0x0000000000000000-mapping.dmp
-
memory/5488-474-0x0000000000000000-mapping.dmp
-
memory/5496-442-0x0000000000000000-mapping.dmp
-
memory/5500-356-0x0000000000000000-mapping.dmp
-
memory/5504-380-0x0000000000000000-mapping.dmp
-
memory/5508-448-0x0000000000000000-mapping.dmp
-
memory/5512-459-0x0000000000000000-mapping.dmp
-
memory/5516-327-0x0000000000000000-mapping.dmp
-
memory/5524-465-0x0000000000000000-mapping.dmp
-
memory/5528-415-0x0000000000000000-mapping.dmp
-
memory/5532-416-0x0000000000000000-mapping.dmp
-
memory/5540-328-0x0000000000000000-mapping.dmp
-
memory/5544-358-0x0000000000000000-mapping.dmp
-
memory/5548-417-0x0000000000000000-mapping.dmp
-
memory/5552-492-0x0000000000000000-mapping.dmp
-
memory/5556-381-0x0000000000000000-mapping.dmp
-
memory/5560-431-0x0000000000000000-mapping.dmp
-
memory/5568-400-0x0000000000000000-mapping.dmp
-
memory/5584-329-0x0000000000000000-mapping.dmp
-
memory/5596-401-0x0000000000000000-mapping.dmp
-
memory/5600-357-0x0000000000000000-mapping.dmp
-
memory/5608-330-0x0000000000000000-mapping.dmp
-
memory/5612-458-0x0000000000000000-mapping.dmp
-
memory/5616-441-0x0000000000000000-mapping.dmp
-
memory/5620-403-0x0000000000000000-mapping.dmp
-
memory/5624-418-0x0000000000000000-mapping.dmp
-
memory/5628-360-0x0000000000000000-mapping.dmp
-
memory/5632-382-0x0000000000000000-mapping.dmp
-
memory/5636-359-0x0000000000000000-mapping.dmp
-
memory/5648-450-0x0000000000000000-mapping.dmp
-
memory/5652-331-0x0000000000000000-mapping.dmp
-
memory/5656-419-0x0000000000000000-mapping.dmp
-
memory/5676-332-0x0000000000000000-mapping.dmp
-
memory/5680-361-0x0000000000000000-mapping.dmp
-
memory/5684-498-0x0000000000000000-mapping.dmp
-
memory/5692-484-0x0000000000000000-mapping.dmp
-
memory/5700-402-0x0000000000000000-mapping.dmp
-
memory/5704-489-0x0000000000000000-mapping.dmp
-
memory/5708-384-0x0000000000000000-mapping.dmp
-
memory/5716-434-0x0000000000000000-mapping.dmp
-
memory/5720-333-0x0000000000000000-mapping.dmp
-
memory/5736-470-0x0000000000000000-mapping.dmp
-
memory/5744-334-0x0000000000000000-mapping.dmp
-
memory/5748-386-0x0000000000000000-mapping.dmp
-
memory/5752-362-0x0000000000000000-mapping.dmp
-
memory/5756-385-0x0000000000000000-mapping.dmp
-
memory/5772-491-0x0000000000000000-mapping.dmp
-
memory/5776-475-0x0000000000000000-mapping.dmp
-
memory/5780-363-0x0000000000000000-mapping.dmp
-
memory/5788-335-0x0000000000000000-mapping.dmp
-
memory/5792-443-0x0000000000000000-mapping.dmp
-
memory/5796-478-0x0000000000000000-mapping.dmp
-
memory/5800-404-0x0000000000000000-mapping.dmp
-
memory/5804-480-0x0000000000000000-mapping.dmp
-
memory/5812-336-0x0000000000000000-mapping.dmp
-
memory/5820-466-0x0000000000000000-mapping.dmp
-
memory/5824-388-0x0000000000000000-mapping.dmp
-
memory/5832-405-0x0000000000000000-mapping.dmp
-
memory/5840-406-0x0000000000000000-mapping.dmp
-
memory/5852-421-0x0000000000000000-mapping.dmp
-
memory/5856-337-0x0000000000000000-mapping.dmp
-
memory/5860-444-0x0000000000000000-mapping.dmp
-
memory/5868-364-0x0000000000000000-mapping.dmp
-
memory/5880-338-0x0000000000000000-mapping.dmp
-
memory/5884-408-0x0000000000000000-mapping.dmp
-
memory/5896-365-0x0000000000000000-mapping.dmp
-
memory/5904-422-0x0000000000000000-mapping.dmp
-
memory/5912-485-0x0000000000000000-mapping.dmp
-
memory/5920-366-0x0000000000000000-mapping.dmp
-
memory/5924-339-0x0000000000000000-mapping.dmp
-
memory/5928-467-0x0000000000000000-mapping.dmp
-
memory/5932-387-0x0000000000000000-mapping.dmp
-
memory/5936-452-0x0000000000000000-mapping.dmp
-
memory/5940-420-0x0000000000000000-mapping.dmp
-
memory/5948-340-0x0000000000000000-mapping.dmp
-
memory/5956-451-0x0000000000000000-mapping.dmp
-
memory/5960-455-0x0000000000000000-mapping.dmp
-
memory/5964-389-0x0000000000000000-mapping.dmp
-
memory/5968-390-0x0000000000000000-mapping.dmp
-
memory/5972-368-0x0000000000000000-mapping.dmp
-
memory/5976-433-0x0000000000000000-mapping.dmp
-
memory/5992-341-0x0000000000000000-mapping.dmp
-
memory/6000-473-0x0000000000000000-mapping.dmp
-
memory/6004-367-0x0000000000000000-mapping.dmp
-
memory/6008-407-0x0000000000000000-mapping.dmp
-
memory/6016-342-0x0000000000000000-mapping.dmp
-
memory/6020-460-0x0000000000000000-mapping.dmp
-
memory/6024-472-0x0000000000000000-mapping.dmp
-
memory/6028-370-0x0000000000000000-mapping.dmp
-
memory/6032-424-0x0000000000000000-mapping.dmp
-
memory/6040-454-0x0000000000000000-mapping.dmp
-
memory/6044-453-0x0000000000000000-mapping.dmp
-
memory/6048-483-0x0000000000000000-mapping.dmp
-
memory/6052-445-0x0000000000000000-mapping.dmp
-
memory/6056-369-0x0000000000000000-mapping.dmp
-
memory/6060-343-0x0000000000000000-mapping.dmp
-
memory/6064-391-0x0000000000000000-mapping.dmp
-
memory/6076-409-0x0000000000000000-mapping.dmp
-
memory/6084-344-0x0000000000000000-mapping.dmp
-
memory/6092-425-0x0000000000000000-mapping.dmp
-
memory/6096-461-0x0000000000000000-mapping.dmp
-
memory/6100-436-0x0000000000000000-mapping.dmp
-
memory/6108-371-0x0000000000000000-mapping.dmp
-
memory/6112-411-0x0000000000000000-mapping.dmp
-
memory/6116-446-0x0000000000000000-mapping.dmp
-
memory/6120-423-0x0000000000000000-mapping.dmp
-
memory/6124-471-0x0000000000000000-mapping.dmp
-
memory/6128-345-0x0000000000000000-mapping.dmp
-
memory/6132-447-0x0000000000000000-mapping.dmp
-
memory/6168-502-0x0000000000000000-mapping.dmp
-
memory/6212-503-0x0000000000000000-mapping.dmp
-
memory/6236-504-0x0000000000000000-mapping.dmp
-
memory/6280-505-0x0000000000000000-mapping.dmp
-
memory/6304-506-0x0000000000000000-mapping.dmp
-
memory/6348-507-0x0000000000000000-mapping.dmp
-
memory/6372-508-0x0000000000000000-mapping.dmp
-
memory/6416-509-0x0000000000000000-mapping.dmp
-
memory/6440-510-0x0000000000000000-mapping.dmp
-
memory/6484-511-0x0000000000000000-mapping.dmp
-
memory/6508-512-0x0000000000000000-mapping.dmp
-
memory/6552-513-0x0000000000000000-mapping.dmp
-
memory/6576-514-0x0000000000000000-mapping.dmp
-
memory/6620-515-0x0000000000000000-mapping.dmp
-
memory/6644-516-0x0000000000000000-mapping.dmp
-
memory/6692-517-0x0000000000000000-mapping.dmp
-
memory/6716-518-0x0000000000000000-mapping.dmp
-
memory/6760-519-0x0000000000000000-mapping.dmp
-
memory/6784-520-0x0000000000000000-mapping.dmp
-
memory/6828-521-0x0000000000000000-mapping.dmp
-
memory/6852-522-0x0000000000000000-mapping.dmp
-
memory/6896-523-0x0000000000000000-mapping.dmp
-
memory/6920-524-0x0000000000000000-mapping.dmp
-
memory/6964-525-0x0000000000000000-mapping.dmp
-
memory/6992-526-0x0000000000000000-mapping.dmp
-
memory/7036-527-0x0000000000000000-mapping.dmp
-
memory/7060-528-0x0000000000000000-mapping.dmp
-
memory/7104-529-0x0000000000000000-mapping.dmp