Overview

overview

10

Static

static

10

bazaar.202...nt.exe

windows7-x64

10

bazaar.202...nt.exe

windows10-2004-x64

10

bazaar.202...nt.exe

windows7-x64

10

bazaar.202...nt.exe

windows10-2004-x64

10

bazaar.202...an.exe

windows7-x64

10

bazaar.202...an.exe

windows10-2004-x64

10

bazaar.202...et.exe

windows7-x64

10

bazaar.202...et.exe

windows10-2004-x64

10

bazaar.202...lf.exe

windows7-x64

10

bazaar.202...lf.exe

windows10-2004-x64

10

bazaar.202...lf.exe

windows7-x64

10

bazaar.202...lf.exe

windows10-2004-x64

10

bazaar.202...it.exe

windows7-x64

9

bazaar.202...it.exe

windows10-2004-x64

9

bazaar.202...nt.exe

windows7-x64

10

bazaar.202...nt.exe

windows10-2004-x64

10

bazaar.202...an.exe

windows7-x64

10

bazaar.202...an.exe

windows10-2004-x64

10

bazaar.202...an.exe

windows7-x64

10

bazaar.202...an.exe

windows10-2004-x64

10

bazaar.202...an.exe

windows7-x64

10

bazaar.202...an.exe

windows10-2004-x64

10

bazaar.202...an.exe

windows7-x64

10

bazaar.202...an.exe

windows10-2004-x64

10

bazaar.202...an.exe

windows7-x64

10

bazaar.202...an.exe

windows10-2004-x64

10

bazaar.202...an.exe

windows7-x64

1

bazaar.202...an.exe

windows10-2004-x64

1

bazaar.202...an.exe

windows7-x64

10

bazaar.202...an.exe

windows10-2004-x64

10

bazaar.202...an.exe

windows7-x64

10

bazaar.202...an.exe

windows10-2004-x64

10

Resubmissions

20-09-2024 07:43

240920-jkdj5avhqa 10

16-09-2024 13:49

240916-q4rz7a1apg 10

Analysis

  • max time kernel
    150s
  • max time network
    97s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16-09-2024 13:49

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    bazaar.2020.02/Backdoor.Win32.Delf.exe

  • Size

    350KB

  • MD5

    7705cbb21d01877e944fda88286ac48a

  • SHA1

    c994c00fbd6b935f963be4bd548a202bda50cb07

  • SHA256

    fa3981228b5b124a8b51fa64f8b6d5d05899165647dc50322b717d7ab63d4997

  • SHA512

    88cf000b606ea0f7d8ef12da9b9a609468e674c37af679f15ae37ddc5fa416319d739d99ce139436d5ff3da3d00f15343be5f4bcc19beb3d06c92d550f0d9345

  • SSDEEP

    6144:WD7cY2fgssM7Wirg9KXylmRiL+QMeC/i6isqX7UovnONztByipwxZODavMMV3:Wl8E4w5huat7UovONzbXwtEMV

Score
10/10
darkcometmikel50discoverypersistencerattrojanupx

Malware Config

Extracted

Family

darkcomet

Botnet

Mikel50

C2

ventoclima.hopto.org:58589

Mutex

DC_MUTEX-1M2MJNL

Attributes
  • InstallPath

    temp\taskmgrk.exe

  • gencode

    n7v7WtYPsejG

  • install

    true

  • offline_keylogger

    true

  • password

    Mikel2019

  • persistence

    false

  • reg_key

    taskmgrk

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet
  • Modifies WinLogon for persistence 2 TTPs 64 IoCs
    persistence
  • Checks computer location settings 2 TTPs 64 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 64 IoCs
  • UPX packed file 64 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 64 IoCs
    persistence
  • Drops file in System32 directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bazaar.2020.02\Backdoor.Win32.Delf.exe
    "C:\Users\Admin\AppData\Local\Temp\bazaar.2020.02\Backdoor.Win32.Delf.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3896
    • C:\Windows\SysWOW64\temp\taskmgrk.exe
      "C:\Windows\system32\temp\taskmgrk.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in System32 directory
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3704
      • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
        "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4540
        • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
          "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:2552
          • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
            "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
            5⤵
            • Executes dropped EXE
            • Modifies registry class
            • Suspicious use of WriteProcessMemory
            PID:396
            • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
              "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
              6⤵
              • Modifies WinLogon for persistence
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:668
              • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                7⤵
                • Executes dropped EXE
                • Adds Run key to start application
                • Suspicious use of WriteProcessMemory
                PID:972
                • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
                  "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
                  8⤵
                  • Modifies WinLogon for persistence
                  • Executes dropped EXE
                  • Adds Run key to start application
                  • System Location Discovery: System Language Discovery
                  • Modifies registry class
                  • Suspicious use of WriteProcessMemory
                  PID:1564
                  • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                    "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                    9⤵
                    • Modifies WinLogon for persistence
                    • Checks computer location settings
                    • Executes dropped EXE
                    • Suspicious use of WriteProcessMemory
                    PID:844
                    • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
                      "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
                      10⤵
                      • Modifies WinLogon for persistence
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:3452
                      • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                        "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                        11⤵
                        • Checks computer location settings
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of WriteProcessMemory
                        PID:452
                        • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
                          "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
                          12⤵
                          • Modifies WinLogon for persistence
                          • Checks computer location settings
                          • Executes dropped EXE
                          • Modifies registry class
                          • Suspicious use of WriteProcessMemory
                          PID:4288
                          • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                            "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                            13⤵
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            • Suspicious use of WriteProcessMemory
                            PID:4472
                            • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
                              "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
                              14⤵
                              • Checks computer location settings
                              • Executes dropped EXE
                              • Suspicious use of WriteProcessMemory
                              PID:4732
                              • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                                "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                                15⤵
                                • Executes dropped EXE
                                • Adds Run key to start application
                                • Drops file in System32 directory
                                • Suspicious use of WriteProcessMemory
                                PID:3916
                                • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
                                  "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
                                  16⤵
                                  • Executes dropped EXE
                                  • Suspicious use of WriteProcessMemory
                                  PID:4572
                                  • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                                    "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Suspicious use of WriteProcessMemory
                                    PID:4720
                                    • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
                                      "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
                                      18⤵
                                      • Executes dropped EXE
                                      • Drops file in System32 directory
                                      • Modifies registry class
                                      • Suspicious use of WriteProcessMemory
                                      PID:4956
                                      • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                                        "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                                        19⤵
                                        • Checks computer location settings
                                        • Executes dropped EXE
                                        • Suspicious use of WriteProcessMemory
                                        PID:3720
                                        • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
                                          "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
                                          20⤵
                                          • Modifies WinLogon for persistence
                                          • Executes dropped EXE
                                          • Modifies registry class
                                          • Suspicious use of WriteProcessMemory
                                          PID:316
                                          • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                                            "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Modifies registry class
                                            • Suspicious use of WriteProcessMemory
                                            PID:2440
                                            • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
                                              "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
                                              22⤵
                                              • Executes dropped EXE
                                              • Suspicious use of WriteProcessMemory
                                              PID:2904
                                              • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                                                "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Modifies registry class
                                                PID:3856
                                                • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
                                                  "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
                                                  24⤵
                                                  • Checks computer location settings
                                                  • Executes dropped EXE
                                                  • Drops file in System32 directory
                                                  PID:4448
                                                  • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                                                    "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Adds Run key to start application
                                                    • Drops file in System32 directory
                                                    PID:972
                                                    • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
                                                      "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
                                                      26⤵
                                                      • Modifies WinLogon for persistence
                                                      • Executes dropped EXE
                                                      • Drops file in System32 directory
                                                      • Modifies registry class
                                                      PID:5092
                                                      • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                                                        "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        PID:960
                                                        • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
                                                          "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
                                                          28⤵
                                                          • Executes dropped EXE
                                                          PID:2488
                                                          • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                                                            "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                                                            29⤵
                                                            • Modifies WinLogon for persistence
                                                            • Executes dropped EXE
                                                            • Drops file in System32 directory
                                                            • System Location Discovery: System Language Discovery
                                                            • Modifies registry class
                                                            PID:632
                                                            • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
                                                              "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
                                                              30⤵
                                                              • Executes dropped EXE
                                                              PID:4720
                                                              • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                                                                "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                PID:1472
                                                                • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
                                                                  "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
                                                                  32⤵
                                                                  • Executes dropped EXE
                                                                  PID:3728
                                                                  • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                                                                    "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                                                                    33⤵
                                                                    • Checks computer location settings
                                                                    • Executes dropped EXE
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:1096
                                                                    • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
                                                                      "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
                                                                      34⤵
                                                                      • Executes dropped EXE
                                                                      • Drops file in System32 directory
                                                                      PID:4752
                                                                      • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                                                                        "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Adds Run key to start application
                                                                        • Drops file in System32 directory
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:2996
                                                                        • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
                                                                          "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
                                                                          36⤵
                                                                          • Checks computer location settings
                                                                          • Executes dropped EXE
                                                                          • Adds Run key to start application
                                                                          • Modifies registry class
                                                                          PID:4304
                                                                          • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                                                                            "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            PID:2688
                                                                            • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
                                                                              "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
                                                                              38⤵
                                                                              • Executes dropped EXE
                                                                              • Adds Run key to start application
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:2540
                                                                              • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                                                                                "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Modifies registry class
                                                                                PID:4260
                                                                                • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
                                                                                  "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
                                                                                  40⤵
                                                                                  • Checks computer location settings
                                                                                  • Executes dropped EXE
                                                                                  • Adds Run key to start application
                                                                                  • Modifies registry class
                                                                                  PID:2316
                                                                                  • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                                                                                    "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                                                                                    41⤵
                                                                                    • Modifies WinLogon for persistence
                                                                                    • Executes dropped EXE
                                                                                    • Modifies registry class
                                                                                    PID:3308
                                                                                    • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
                                                                                      "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
                                                                                      42⤵
                                                                                      • Executes dropped EXE
                                                                                      • Modifies registry class
                                                                                      PID:1564
                                                                                      • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                                                                                        "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        PID:3344
                                                                                        • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
                                                                                          "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
                                                                                          44⤵
                                                                                          • Modifies WinLogon for persistence
                                                                                          • Checks computer location settings
                                                                                          • Executes dropped EXE
                                                                                          • Adds Run key to start application
                                                                                          PID:1376
                                                                                          • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                                                                                            "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                                                                                            45⤵
                                                                                            • Checks computer location settings
                                                                                            • Executes dropped EXE
                                                                                            • Adds Run key to start application
                                                                                            PID:1676
                                                                                            • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
                                                                                              "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
                                                                                              46⤵
                                                                                              • Modifies WinLogon for persistence
                                                                                              • Executes dropped EXE
                                                                                              • Adds Run key to start application
                                                                                              PID:3548
                                                                                              • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                                                                                                "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Drops file in System32 directory
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                PID:4576
                                                                                                • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
                                                                                                  "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                  48⤵
                                                                                                  • Checks computer location settings
                                                                                                  • Executes dropped EXE
                                                                                                  • Drops file in System32 directory
                                                                                                  PID:4548
                                                                                                  • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                                                                                                    "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    PID:976
                                                                                                    • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
                                                                                                      "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                      50⤵
                                                                                                      • Checks computer location settings
                                                                                                      • Executes dropped EXE
                                                                                                      PID:4300
                                                                                                      • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                                                                                                        "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                        51⤵
                                                                                                        • Modifies WinLogon for persistence
                                                                                                        • Executes dropped EXE
                                                                                                        PID:388
                                                                                                        • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
                                                                                                          "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                          52⤵
                                                                                                          • Executes dropped EXE
                                                                                                          PID:3184
                                                                                                          • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                                                                                                            "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            PID:3420
                                                                                                            • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
                                                                                                              "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                              54⤵
                                                                                                              • Executes dropped EXE
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              PID:1388
                                                                                                              • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                PID:1656
                                                                                                                • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                  "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                  56⤵
                                                                                                                  • Modifies WinLogon for persistence
                                                                                                                  • Executes dropped EXE
                                                                                                                  • Modifies registry class
                                                                                                                  PID:3180
                                                                                                                  • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                    "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                    57⤵
                                                                                                                    • Modifies WinLogon for persistence
                                                                                                                    • Checks computer location settings
                                                                                                                    • Executes dropped EXE
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    PID:4288
                                                                                                                    • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                      "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                      58⤵
                                                                                                                      • Checks computer location settings
                                                                                                                      • Executes dropped EXE
                                                                                                                      • Adds Run key to start application
                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                      PID:2028
                                                                                                                      • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                        "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                        59⤵
                                                                                                                        • Modifies WinLogon for persistence
                                                                                                                        • Executes dropped EXE
                                                                                                                        PID:2796
                                                                                                                        • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                          "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                          60⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          • Modifies registry class
                                                                                                                          PID:3264
                                                                                                                          • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                            "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                            61⤵
                                                                                                                            • Modifies WinLogon for persistence
                                                                                                                            • Executes dropped EXE
                                                                                                                            PID:4468
                                                                                                                            • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                              "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                              62⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              PID:3140
                                                                                                                              • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                63⤵
                                                                                                                                • Modifies WinLogon for persistence
                                                                                                                                • Executes dropped EXE
                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                PID:4576
                                                                                                                                • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                  "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                  64⤵
                                                                                                                                  • Checks computer location settings
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • Drops file in System32 directory
                                                                                                                                  PID:2924
                                                                                                                                  • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                    "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                    65⤵
                                                                                                                                    • Checks computer location settings
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    • Drops file in System32 directory
                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                    PID:4548
                                                                                                                                    • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                      "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                      66⤵
                                                                                                                                      • Adds Run key to start application
                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                      PID:1584
                                                                                                                                      • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                        "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                        67⤵
                                                                                                                                        • Checks computer location settings
                                                                                                                                        • Adds Run key to start application
                                                                                                                                        PID:1676
                                                                                                                                        • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                          "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                          68⤵
                                                                                                                                          • Adds Run key to start application
                                                                                                                                          PID:4764
                                                                                                                                          • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                            "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                            69⤵
                                                                                                                                            • Checks computer location settings
                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                            PID:1480
                                                                                                                                            • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                              "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                              70⤵
                                                                                                                                              • Checks computer location settings
                                                                                                                                              PID:4576
                                                                                                                                              • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                71⤵
                                                                                                                                                • Modifies registry class
                                                                                                                                                PID:4964
                                                                                                                                                • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                  "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                  72⤵
                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                  PID:2856
                                                                                                                                                  • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                    "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                    73⤵
                                                                                                                                                    • Checks computer location settings
                                                                                                                                                    PID:1552
                                                                                                                                                    • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                      "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                      74⤵
                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                      PID:3100
                                                                                                                                                      • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                        "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                        75⤵
                                                                                                                                                        • Adds Run key to start application
                                                                                                                                                        PID:440
                                                                                                                                                        • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                          "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                          76⤵
                                                                                                                                                          • Adds Run key to start application
                                                                                                                                                          • Modifies registry class
                                                                                                                                                          PID:2616
                                                                                                                                                          • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                            "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                            77⤵
                                                                                                                                                              PID:3036
                                                                                                                                                              • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                78⤵
                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                PID:1760
                                                                                                                                                                • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                  "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                  79⤵
                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                  PID:1656
                                                                                                                                                                  • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                    "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                    80⤵
                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                    PID:1624
                                                                                                                                                                    • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                      "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                      81⤵
                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                      PID:1016
                                                                                                                                                                      • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                        "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                        82⤵
                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                        PID:316
                                                                                                                                                                        • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                          "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                          83⤵
                                                                                                                                                                          • Modifies WinLogon for persistence
                                                                                                                                                                          PID:4992
                                                                                                                                                                          • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                            "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                            84⤵
                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                            PID:5004
                                                                                                                                                                            • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                              "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                              85⤵
                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                              PID:1004
                                                                                                                                                                              • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                86⤵
                                                                                                                                                                                  PID:3972
                                                                                                                                                                                  • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                    "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                    87⤵
                                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                    PID:1332
                                                                                                                                                                                    • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                      "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                      88⤵
                                                                                                                                                                                      • Modifies WinLogon for persistence
                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                      PID:3260
                                                                                                                                                                                      • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                        "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                        89⤵
                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                        PID:1628
                                                                                                                                                                                        • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                          "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                          90⤵
                                                                                                                                                                                          • Adds Run key to start application
                                                                                                                                                                                          PID:216
                                                                                                                                                                                          • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                            "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                            91⤵
                                                                                                                                                                                            • Modifies WinLogon for persistence
                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                            • Adds Run key to start application
                                                                                                                                                                                            PID:3872
                                                                                                                                                                                            • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                              "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                              92⤵
                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                              • Adds Run key to start application
                                                                                                                                                                                              PID:2440
                                                                                                                                                                                              • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                93⤵
                                                                                                                                                                                                • Modifies WinLogon for persistence
                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                PID:2184
                                                                                                                                                                                                • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                  "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                  94⤵
                                                                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                                  PID:1672
                                                                                                                                                                                                  • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                    "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                    95⤵
                                                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                    PID:944
                                                                                                                                                                                                    • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                      "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                      96⤵
                                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                                      PID:4764
                                                                                                                                                                                                      • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                        "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                        97⤵
                                                                                                                                                                                                        • Modifies WinLogon for persistence
                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                        PID:2640
                                                                                                                                                                                                        • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                          "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                          98⤵
                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                          PID:1156
                                                                                                                                                                                                          • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                            "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                            99⤵
                                                                                                                                                                                                              PID:1996
                                                                                                                                                                                                              • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                100⤵
                                                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                                                PID:4992
                                                                                                                                                                                                                • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                  "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                  101⤵
                                                                                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                                                                                  PID:2148
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                    "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                    102⤵
                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                                                    PID:4424
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                      "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                      103⤵
                                                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                                                      PID:3304
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                        "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                        104⤵
                                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                                        PID:2400
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                          "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                          105⤵
                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                          PID:4488
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                            "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                            106⤵
                                                                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                                                                            PID:1888
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                              "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                              107⤵
                                                                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                              PID:4036
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                108⤵
                                                                                                                                                                                                                                • Modifies WinLogon for persistence
                                                                                                                                                                                                                                • Adds Run key to start application
                                                                                                                                                                                                                                PID:4192
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                  "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                  109⤵
                                                                                                                                                                                                                                    PID:4876
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                      "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                      110⤵
                                                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                                                                                                      PID:4840
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                        "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                        111⤵
                                                                                                                                                                                                                                        • Modifies WinLogon for persistence
                                                                                                                                                                                                                                        • Adds Run key to start application
                                                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                                                        PID:880
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                          "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                          112⤵
                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                          PID:3340
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                            "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                            113⤵
                                                                                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                                                                                            PID:2840
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                              "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                              114⤵
                                                                                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                              PID:1624
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                115⤵
                                                                                                                                                                                                                                                  PID:2176
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                    "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                    116⤵
                                                                                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                                                                                    PID:3588
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                      "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                      117⤵
                                                                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                      PID:1708
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                        "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                        118⤵
                                                                                                                                                                                                                                                          PID:2904
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                            "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                            119⤵
                                                                                                                                                                                                                                                            • Adds Run key to start application
                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                            PID:4864
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                              "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                              120⤵
                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                                                                              PID:4544
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                121⤵
                                                                                                                                                                                                                                                                • Adds Run key to start application
                                                                                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                PID:5068
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                  "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                  122⤵
                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                  PID:3116
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                    "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                    123⤵
                                                                                                                                                                                                                                                                    • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                                                                                                    PID:2952
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                      "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                      124⤵
                                                                                                                                                                                                                                                                      • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                                                                                                                                      PID:2916
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                        "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                        125⤵
                                                                                                                                                                                                                                                                        • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                                                                                        PID:1772
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                          "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                          126⤵
                                                                                                                                                                                                                                                                          • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                          PID:1160
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                            "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                            127⤵
                                                                                                                                                                                                                                                                            • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                            PID:1484
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                              "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                              128⤵
                                                                                                                                                                                                                                                                                PID:3692
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                  "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                  129⤵
                                                                                                                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                                                                                                                  PID:4088
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                    "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                    130⤵
                                                                                                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                                                                                                                    PID:1652
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                      "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                      131⤵
                                                                                                                                                                                                                                                                                        PID:2800
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                          "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                          132⤵
                                                                                                                                                                                                                                                                                          • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                                                                          PID:2640
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                            "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                            133⤵
                                                                                                                                                                                                                                                                                              PID:2796
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                                "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                                134⤵
                                                                                                                                                                                                                                                                                                • Adds Run key to start application
                                                                                                                                                                                                                                                                                                PID:4596
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                                  "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                                  135⤵
                                                                                                                                                                                                                                                                                                    PID:1676
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                                      "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                                      136⤵
                                                                                                                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                                                                                                                                      PID:644
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                                        "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                                        137⤵
                                                                                                                                                                                                                                                                                                          PID:4468
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                                            "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                                            138⤵
                                                                                                                                                                                                                                                                                                              PID:3756
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                                                "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                                                139⤵
                                                                                                                                                                                                                                                                                                                • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                PID:5072
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                                                  "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                                                  140⤵
                                                                                                                                                                                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                  PID:4396
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                                                    "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                                                    141⤵
                                                                                                                                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                                                                                                                                    PID:3116
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                                                      "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                                                      142⤵
                                                                                                                                                                                                                                                                                                                      • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                      PID:2264
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                                                        "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                                                        143⤵
                                                                                                                                                                                                                                                                                                                        • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                        PID:1208
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                                                          "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                                                          144⤵
                                                                                                                                                                                                                                                                                                                          • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                          PID:3080
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                                                            "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                                                            145⤵
                                                                                                                                                                                                                                                                                                                            • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                            • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                            PID:1332
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                                                              "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                                                              146⤵
                                                                                                                                                                                                                                                                                                                              • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                              PID:3288
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                                                                "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                                                                147⤵
                                                                                                                                                                                                                                                                                                                                  PID:4484
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                                                                    148⤵
                                                                                                                                                                                                                                                                                                                                      PID:772
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                                                                        "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                                                                        149⤵
                                                                                                                                                                                                                                                                                                                                          PID:3540
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                                                                            150⤵
                                                                                                                                                                                                                                                                                                                                            • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                            PID:4468
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                                                                              "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                                                                              151⤵
                                                                                                                                                                                                                                                                                                                                              • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                              PID:1384
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                                                                                152⤵
                                                                                                                                                                                                                                                                                                                                                  PID:1268
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                                                                                    153⤵
                                                                                                                                                                                                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                    PID:1096
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                                                                                      154⤵
                                                                                                                                                                                                                                                                                                                                                        PID:3552
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                                                                                          155⤵
                                                                                                                                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                          PID:2148
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                                                                                            156⤵
                                                                                                                                                                                                                                                                                                                                                            • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                            PID:1880
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                                                                                              157⤵
                                                                                                                                                                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                              PID:3612
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                                                                                                158⤵
                                                                                                                                                                                                                                                                                                                                                                • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                PID:5020
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                                                                                                  159⤵
                                                                                                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                  PID:3748
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                                                                                                    160⤵
                                                                                                                                                                                                                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                    PID:5064
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                                                                                                      161⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:3308
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                                                                                                          162⤵
                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                          PID:3428
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                                                                                                            163⤵
                                                                                                                                                                                                                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                            PID:4560
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                                                                                                              164⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:5060
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                                                                                                                  165⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                  PID:3756
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                                                                                                                    166⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                    PID:2536
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                                                                                                                      167⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                      PID:3768
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                                                                                                                        168⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                        PID:216
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                                                                                                                          169⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                          PID:4336
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                                                                                                                            170⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                            PID:3760
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                                                                                                                              171⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                              PID:3708
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                                                                                                                                172⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                PID:1396
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                                                                                                                                  173⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:2956
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                                                                                                                                      174⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:4452
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                                                                                                                                          175⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                          PID:960
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                                                                                                                                            176⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                            • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                            PID:3492
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                                                                                                                                              177⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                              • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                              PID:1760
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                                • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                                PID:4024
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                  179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4484
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                    180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3340
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                      181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5028
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                        182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2828
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                            183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4116
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                              184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                              • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3980
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2540
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                    186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3548
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                      187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2184
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                        188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3116
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                          189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4336
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                              190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3760
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:852
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                  192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4952
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                      193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:516
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                          194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1432
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                            195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4928
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3576
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4344
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3044
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1628
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3308
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3380
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4676
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1864
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1156
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2064
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2616
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:216
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1440
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:876
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1488
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4444
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4952
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2856
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1472
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3716
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5060
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4700
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:932
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2152
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1940
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4092
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3288
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            224⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5076
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              225⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4424
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                226⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1672
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  227⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4192
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    228⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5040
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      229⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3100
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        230⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1836
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          231⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:644
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              232⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3832
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                233⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1112
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  234⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:756
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    235⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3332
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      236⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:816
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        237⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1692
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          238⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2008
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            239⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4908
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              240⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4576
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  241⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2424
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    242⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      243⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1268
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        244⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4916
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          245⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:644
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            246⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2108
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              247⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1332
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                248⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1732
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  249⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:844
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    250⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4724
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      251⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1652
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\system32\temp\n7v7WtYPsejG\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        252⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2688
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\temp\n7v7WtYPsejG\taskmgrk.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\system32\temp\n7v7WtYPsejG\taskmgrk.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          253⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3016

                                                                  Network

                                                                  MITRE ATT&CK Enterprise v15

                                                                  Replay Monitor

                                                                  Loading Replay Monitor...

                                                                  Downloads

                                                                  • C:\Windows\SysWOW64\temp\taskmgrk.exe
                                                                    Filesize

                                                                    350KB

                                                                    MD5

                                                                    7705cbb21d01877e944fda88286ac48a

                                                                    SHA1

                                                                    c994c00fbd6b935f963be4bd548a202bda50cb07

                                                                    SHA256

                                                                    fa3981228b5b124a8b51fa64f8b6d5d05899165647dc50322b717d7ab63d4997

                                                                    SHA512

                                                                    88cf000b606ea0f7d8ef12da9b9a609468e674c37af679f15ae37ddc5fa416319d739d99ce139436d5ff3da3d00f15343be5f4bcc19beb3d06c92d550f0d9345

                                                                    Download Submit

                                                                  • memory/216-5220-0x0000000000400000-0x00000000004EB000-memory.dmp

                                                                    Filesize

                                                                    940KB

                                                                    Download

                                                                  • memory/316-1244-0x0000000000400000-0x00000000004EB000-memory.dmp

                                                                    Filesize

                                                                    940KB

                                                                    Download

                                                                  • memory/316-4740-0x0000000000400000-0x00000000004EB000-memory.dmp

                                                                    Filesize

                                                                    940KB

                                                                    Download

                                                                  • memory/388-2997-0x0000000000400000-0x00000000004EB000-memory.dmp

                                                                    Filesize

                                                                    940KB

                                                                    Download

                                                                  • memory/396-312-0x0000000000400000-0x00000000004EB000-memory.dmp

                                                                    Filesize

                                                                    940KB

                                                                    Download

                                                                  • memory/440-4378-0x0000000000400000-0x00000000004EB000-memory.dmp

                                                                    Filesize

                                                                    940KB

                                                                    Download

                                                                  • memory/452-623-0x0000000000400000-0x00000000004EB000-memory.dmp

                                                                    Filesize

                                                                    940KB

                                                                    Download

                                                                  • memory/452-685-0x0000000000400000-0x00000000004EB000-memory.dmp

                                                                    Filesize

                                                                    940KB

                                                                    Download

                                                                  • memory/632-1734-0x0000000000400000-0x00000000004EB000-memory.dmp

                                                                    Filesize

                                                                    940KB

                                                                    Download

                                                                  • memory/668-374-0x0000000000400000-0x00000000004EB000-memory.dmp

                                                                    Filesize

                                                                    940KB

                                                                    Download

                                                                  • memory/844-560-0x0000000000400000-0x00000000004EB000-memory.dmp

                                                                    Filesize

                                                                    940KB

                                                                    Download

                                                                  • memory/944-5520-0x0000000000400000-0x00000000004EB000-memory.dmp

                                                                    Filesize

                                                                    940KB

                                                                    Download

                                                                  • memory/960-1614-0x0000000000400000-0x00000000004EB000-memory.dmp

                                                                    Filesize

                                                                    940KB

                                                                    Download

                                                                  • memory/972-1553-0x0000000000400000-0x00000000004EB000-memory.dmp

                                                                    Filesize

                                                                    940KB

                                                                    Download

                                                                  • memory/972-1493-0x0000000000400000-0x00000000004EB000-memory.dmp

                                                                    Filesize

                                                                    940KB

                                                                    Download

                                                                  • memory/972-436-0x0000000000400000-0x00000000004EB000-memory.dmp

                                                                    Filesize

                                                                    940KB

                                                                    Download

                                                                  • memory/976-2877-0x0000000000400000-0x00000000004EB000-memory.dmp

                                                                    Filesize

                                                                    940KB

                                                                    Download

                                                                  • memory/1004-4920-0x0000000000400000-0x00000000004EB000-memory.dmp

                                                                    Filesize

                                                                    940KB

                                                                    Download

                                                                  • memory/1016-4680-0x0000000000400000-0x00000000004EB000-memory.dmp

                                                                    Filesize

                                                                    940KB

                                                                    Download

                                                                  • memory/1096-1975-0x0000000000400000-0x00000000004EB000-memory.dmp

                                                                    Filesize

                                                                    940KB

                                                                    Download

                                                                  • memory/1332-5040-0x0000000000400000-0x00000000004EB000-memory.dmp

                                                                    Filesize

                                                                    940KB

                                                                    Download

                                                                  • memory/1376-2634-0x0000000000400000-0x00000000004EB000-memory.dmp

                                                                    Filesize

                                                                    940KB

                                                                    Download

                                                                  • memory/1388-3176-0x0000000000400000-0x00000000004EB000-memory.dmp

                                                                    Filesize

                                                                    940KB

                                                                    Download

                                                                  • memory/1472-1855-0x0000000000400000-0x00000000004EB000-memory.dmp

                                                                    Filesize

                                                                    940KB

                                                                    Download

                                                                  • memory/1472-1793-0x0000000000400000-0x00000000004EB000-memory.dmp

                                                                    Filesize

                                                                    940KB

                                                                    Download

                                                                  • memory/1480-4018-0x0000000000400000-0x00000000004EB000-memory.dmp

                                                                    Filesize

                                                                    940KB

                                                                    Download

                                                                  • memory/1552-4258-0x0000000000400000-0x00000000004EB000-memory.dmp

                                                                    Filesize

                                                                    940KB

                                                                    Download

                                                                  • memory/1564-498-0x0000000000400000-0x00000000004EB000-memory.dmp

                                                                    Filesize

                                                                    940KB

                                                                    Download

                                                                  • memory/1564-2514-0x0000000000400000-0x00000000004EB000-memory.dmp

                                                                    Filesize

                                                                    940KB

                                                                    Download

                                                                  • memory/1584-3896-0x0000000000400000-0x00000000004EB000-memory.dmp

                                                                    Filesize

                                                                    940KB

                                                                    Download

                                                                  • memory/1624-4620-0x0000000000400000-0x00000000004EB000-memory.dmp

                                                                    Filesize

                                                                    940KB

                                                                    Download

                                                                  • memory/1628-5160-0x0000000000400000-0x00000000004EB000-memory.dmp

                                                                    Filesize

                                                                    940KB

                                                                    Download

                                                                  • memory/1656-4560-0x0000000000400000-0x00000000004EB000-memory.dmp

                                                                    Filesize

                                                                    940KB

                                                                    Download

                                                                  • memory/1656-3236-0x0000000000400000-0x00000000004EB000-memory.dmp

                                                                    Filesize

                                                                    940KB

                                                                    Download

                                                                  • memory/1672-5460-0x0000000000400000-0x00000000004EB000-memory.dmp

                                                                    Filesize

                                                                    940KB

                                                                    Download

                                                                  • memory/1676-3898-0x0000000000400000-0x00000000004EB000-memory.dmp

                                                                    Filesize

                                                                    940KB

                                                                    Download

                                                                  • memory/1676-2637-0x0000000000400000-0x00000000004EB000-memory.dmp

                                                                    Filesize

                                                                    940KB

                                                                    Download

                                                                  • memory/1760-4500-0x0000000000400000-0x00000000004EB000-memory.dmp

                                                                    Filesize

                                                                    940KB

                                                                    Download

                                                                  • memory/2028-3416-0x0000000000400000-0x00000000004EB000-memory.dmp

                                                                    Filesize

                                                                    940KB

                                                                    Download

                                                                  • memory/2184-5400-0x0000000000400000-0x00000000004EB000-memory.dmp

                                                                    Filesize

                                                                    940KB

                                                                    Download

                                                                  • memory/2316-2394-0x0000000000400000-0x00000000004EB000-memory.dmp

                                                                    Filesize

                                                                    940KB

                                                                    Download

                                                                  • memory/2440-1306-0x0000000000400000-0x00000000004EB000-memory.dmp

                                                                    Filesize

                                                                    940KB

                                                                    Download

                                                                  • memory/2440-5340-0x0000000000400000-0x00000000004EB000-memory.dmp

                                                                    Filesize

                                                                    940KB

                                                                    Download

                                                                  • memory/2488-1674-0x0000000000400000-0x00000000004EB000-memory.dmp

                                                                    Filesize

                                                                    940KB

                                                                    Download

                                                                  • memory/2540-2275-0x0000000000400000-0x00000000004EB000-memory.dmp

                                                                    Filesize

                                                                    940KB

                                                                    Download

                                                                  • memory/2552-250-0x0000000000400000-0x00000000004EB000-memory.dmp

                                                                    Filesize

                                                                    940KB

                                                                    Download

                                                                  • memory/2616-4438-0x0000000000400000-0x00000000004EB000-memory.dmp

                                                                    Filesize

                                                                    940KB

                                                                    Download

                                                                  • memory/2688-2215-0x0000000000400000-0x00000000004EB000-memory.dmp

                                                                    Filesize

                                                                    940KB

                                                                    Download

                                                                  • memory/2796-3476-0x0000000000400000-0x00000000004EB000-memory.dmp

                                                                    Filesize

                                                                    940KB

                                                                    Download

                                                                  • memory/2856-4198-0x0000000000400000-0x00000000004EB000-memory.dmp

                                                                    Filesize

                                                                    940KB

                                                                    Download

                                                                  • memory/2904-1368-0x0000000000400000-0x00000000004EB000-memory.dmp

                                                                    Filesize

                                                                    940KB

                                                                    Download

                                                                  • memory/2924-3776-0x0000000000400000-0x00000000004EB000-memory.dmp

                                                                    Filesize

                                                                    940KB

                                                                    Download

                                                                  • memory/2996-2095-0x0000000000400000-0x00000000004EB000-memory.dmp

                                                                    Filesize

                                                                    940KB

                                                                    Download

                                                                  • memory/3036-4440-0x0000000000400000-0x00000000004EB000-memory.dmp

                                                                    Filesize

                                                                    940KB

                                                                    Download

                                                                  • memory/3100-4318-0x0000000000400000-0x00000000004EB000-memory.dmp

                                                                    Filesize

                                                                    940KB

                                                                    Download

                                                                  • memory/3140-3656-0x0000000000400000-0x00000000004EB000-memory.dmp

                                                                    Filesize

                                                                    940KB

                                                                    Download

                                                                  • memory/3180-3296-0x0000000000400000-0x00000000004EB000-memory.dmp

                                                                    Filesize

                                                                    940KB

                                                                    Download

                                                                  • memory/3184-3057-0x0000000000400000-0x00000000004EB000-memory.dmp

                                                                    Filesize

                                                                    940KB

                                                                    Download

                                                                  • memory/3260-5100-0x0000000000400000-0x00000000004EB000-memory.dmp

                                                                    Filesize

                                                                    940KB

                                                                    Download

                                                                  • memory/3264-3536-0x0000000000400000-0x00000000004EB000-memory.dmp

                                                                    Filesize

                                                                    940KB

                                                                    Download

                                                                  • memory/3308-2454-0x0000000000400000-0x00000000004EB000-memory.dmp

                                                                    Filesize

                                                                    940KB

                                                                    Download

                                                                  • memory/3344-2574-0x0000000000400000-0x00000000004EB000-memory.dmp

                                                                    Filesize

                                                                    940KB

                                                                    Download

                                                                  • memory/3420-3117-0x0000000000400000-0x00000000004EB000-memory.dmp

                                                                    Filesize

                                                                    940KB

                                                                    Download

                                                                  • memory/3452-622-0x0000000000400000-0x00000000004EB000-memory.dmp

                                                                    Filesize

                                                                    940KB

                                                                    Download

                                                                  • memory/3548-2697-0x0000000000400000-0x00000000004EB000-memory.dmp

                                                                    Filesize

                                                                    940KB

                                                                    Download

                                                                  • memory/3704-126-0x0000000000400000-0x00000000004EB000-memory.dmp

                                                                    Filesize

                                                                    940KB

                                                                    Download

                                                                  • memory/3704-64-0x00000000008C0000-0x00000000008C1000-memory.dmp

                                                                    Filesize

                                                                    4KB

                                                                    Download

                                                                  • memory/3720-1181-0x0000000000400000-0x00000000004EB000-memory.dmp

                                                                    Filesize

                                                                    940KB

                                                                    Download

                                                                  • memory/3728-1915-0x0000000000400000-0x00000000004EB000-memory.dmp

                                                                    Filesize

                                                                    940KB

                                                                    Download

                                                                  • memory/3856-1430-0x0000000000400000-0x00000000004EB000-memory.dmp

                                                                    Filesize

                                                                    940KB

                                                                    Download

                                                                  • memory/3872-5280-0x0000000000400000-0x00000000004EB000-memory.dmp

                                                                    Filesize

                                                                    940KB

                                                                    Download

                                                                  • memory/3896-0-0x0000000000400000-0x00000000004EB000-memory.dmp

                                                                    Filesize

                                                                    940KB

                                                                    Download

                                                                  • memory/3896-1-0x00000000024F0000-0x00000000024F1000-memory.dmp

                                                                    Filesize

                                                                    4KB

                                                                    Download

                                                                  • memory/3896-63-0x0000000000400000-0x00000000004EB000-memory.dmp

                                                                    Filesize

                                                                    940KB

                                                                    Download

                                                                  • memory/3916-932-0x0000000000400000-0x00000000004EB000-memory.dmp

                                                                    Filesize

                                                                    940KB

                                                                    Download

                                                                  • memory/3972-4980-0x0000000000400000-0x00000000004EB000-memory.dmp

                                                                    Filesize

                                                                    940KB

                                                                    Download

                                                                  • memory/4260-2335-0x0000000000400000-0x00000000004EB000-memory.dmp

                                                                    Filesize

                                                                    940KB

                                                                    Download

                                                                  • memory/4288-746-0x0000000000400000-0x00000000004EB000-memory.dmp

                                                                    Filesize

                                                                    940KB

                                                                    Download

                                                                  • memory/4288-3356-0x0000000000400000-0x00000000004EB000-memory.dmp

                                                                    Filesize

                                                                    940KB

                                                                    Download

                                                                  • memory/4300-2937-0x0000000000400000-0x00000000004EB000-memory.dmp

                                                                    Filesize

                                                                    940KB

                                                                    Download

                                                                  • memory/4304-2155-0x0000000000400000-0x00000000004EB000-memory.dmp

                                                                    Filesize

                                                                    940KB

                                                                    Download

                                                                  • memory/4448-1492-0x0000000000400000-0x00000000004EB000-memory.dmp

                                                                    Filesize

                                                                    940KB

                                                                    Download

                                                                  • memory/4468-3596-0x0000000000400000-0x00000000004EB000-memory.dmp

                                                                    Filesize

                                                                    940KB

                                                                    Download

                                                                  • memory/4472-808-0x0000000000400000-0x00000000004EB000-memory.dmp

                                                                    Filesize

                                                                    940KB

                                                                    Download

                                                                  • memory/4540-188-0x0000000000400000-0x00000000004EB000-memory.dmp

                                                                    Filesize

                                                                    940KB

                                                                    Download

                                                                  • memory/4548-2817-0x0000000000400000-0x00000000004EB000-memory.dmp

                                                                    Filesize

                                                                    940KB

                                                                    Download

                                                                  • memory/4548-3836-0x0000000000400000-0x00000000004EB000-memory.dmp

                                                                    Filesize

                                                                    940KB

                                                                    Download

                                                                  • memory/4548-3775-0x0000000000400000-0x00000000004EB000-memory.dmp

                                                                    Filesize

                                                                    940KB

                                                                    Download

                                                                  • memory/4572-995-0x0000000000400000-0x00000000004EB000-memory.dmp

                                                                    Filesize

                                                                    940KB

                                                                    Download

                                                                  • memory/4576-4078-0x0000000000400000-0x00000000004EB000-memory.dmp

                                                                    Filesize

                                                                    940KB

                                                                    Download

                                                                  • memory/4576-2757-0x0000000000400000-0x00000000004EB000-memory.dmp

                                                                    Filesize

                                                                    940KB

                                                                    Download

                                                                  • memory/4576-3716-0x0000000000400000-0x00000000004EB000-memory.dmp

                                                                    Filesize

                                                                    940KB

                                                                    Download

                                                                  • memory/4720-1057-0x0000000000400000-0x00000000004EB000-memory.dmp

                                                                    Filesize

                                                                    940KB

                                                                    Download

                                                                  • memory/4720-1795-0x0000000000400000-0x00000000004EB000-memory.dmp

                                                                    Filesize

                                                                    940KB

                                                                    Download

                                                                  • memory/4732-870-0x0000000000400000-0x00000000004EB000-memory.dmp

                                                                    Filesize

                                                                    940KB

                                                                    Download

                                                                  • memory/4752-2035-0x0000000000400000-0x00000000004EB000-memory.dmp

                                                                    Filesize

                                                                    940KB

                                                                    Download

                                                                  • memory/4764-3958-0x0000000000400000-0x00000000004EB000-memory.dmp

                                                                    Filesize

                                                                    940KB

                                                                    Download

                                                                  • memory/4956-1119-0x0000000000400000-0x00000000004EB000-memory.dmp

                                                                    Filesize

                                                                    940KB

                                                                    Download

                                                                  • memory/4964-4138-0x0000000000400000-0x00000000004EB000-memory.dmp

                                                                    Filesize

                                                                    940KB

                                                                    Download

                                                                  • memory/4992-4800-0x0000000000400000-0x00000000004EB000-memory.dmp

                                                                    Filesize

                                                                    940KB

                                                                    Download

                                                                  • memory/5004-4860-0x0000000000400000-0x00000000004EB000-memory.dmp

                                                                    Filesize

                                                                    940KB

                                                                    Download

                                                                  • memory/5092-1612-0x0000000000400000-0x00000000004EB000-memory.dmp

                                                                    Filesize

                                                                    940KB

                                                                    Download