Overview

overview

10

Static

static

10

6945bd739b...18.exe

windows7-x64

10

6945bd739b...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-10-2024 06:19

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    6945bd739beed82362cab7342482f7e9_JaffaCakes118.exe

  • Size

    271KB

  • MD5

    6945bd739beed82362cab7342482f7e9

  • SHA1

    a2a2e05ab1e1763b95eba9cc724e85cd9da9888a

  • SHA256

    ba78976847aea3bb9aa90e0d5ff6b70f871705f6c509357a5442325b5f013668

  • SHA512

    bf6bedbe7dcb2d5093367200f27404a3d565966245bfe2e38de111ef7b4401602351b6b19b4f54f3901430dea0d5f0b1b0b86d14b12de3a0616d695a82d5a19f

  • SSDEEP

    6144:FD7cY2fgssM7Wirg9KXylmRiL+QMeC/i6isqX7UovnONztByipwxZC/J4Mi+:Fl8E4w5huat7UovONzbXwWhV

Score
10/10
darkcometnextubdiscoverypersistencerattrojanupx

Malware Config

Extracted

Family

darkcomet

Botnet

nextub

C2

haythem1998.no-ip.org:1604

Mutex

DC_MUTEX-MND378A

Attributes
  • InstallPath

    MSDCSC\msdcsc.exe

  • gencode

    DsZMSnRUvhJQ

  • install

    true

  • offline_keylogger

    true

  • persistence

    false

  • reg_key

    MicroUpdate

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet
  • Modifies WinLogon for persistence 2 TTPs 64 IoCs
    persistence
  • Checks computer location settings 2 TTPs 64 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 64 IoCs
  • Adds Run key to start application 2 TTPs 64 IoCs
    persistence
  • Drops file in System32 directory 64 IoCs
  • UPX packed file 54 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6945bd739beed82362cab7342482f7e9_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\6945bd739beed82362cab7342482f7e9_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3224
    • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
      "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
      2⤵
      • Executes dropped EXE
      PID:3752
    • C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
      "C:\Windows\system32\MSDCSC\msdcsc.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:388
      • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
        "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
        3⤵
        • Executes dropped EXE
        PID:4276
      • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe
        "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1848
        • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
          "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
          4⤵
          • Executes dropped EXE
          PID:404
        • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe
          "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe"
          4⤵
          • Modifies WinLogon for persistence
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:1364
          • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
            "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
            5⤵
            • Executes dropped EXE
            PID:1864
          • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe
            "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe"
            5⤵
            • Executes dropped EXE
            • Drops file in System32 directory
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2580
            • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
              "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
              6⤵
              • Executes dropped EXE
              PID:3180
            • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe
              "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe"
              6⤵
              • Executes dropped EXE
              • Adds Run key to start application
              • Drops file in System32 directory
              • Suspicious use of WriteProcessMemory
              PID:3216
              • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                7⤵
                • Executes dropped EXE
                PID:788
              • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe
                "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe"
                7⤵
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:3080
                • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                  "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                  8⤵
                  • Executes dropped EXE
                  PID:3060
                • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe
                  "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe"
                  8⤵
                  • Modifies WinLogon for persistence
                  • Executes dropped EXE
                  • Drops file in System32 directory
                  • Suspicious use of WriteProcessMemory
                  PID:2544
                  • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                    "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                    9⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    PID:3092
                  • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe
                    "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe"
                    9⤵
                    • Modifies WinLogon for persistence
                    • Executes dropped EXE
                    • Suspicious use of WriteProcessMemory
                    PID:4428
                    • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                      "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                      10⤵
                      • Executes dropped EXE
                      PID:3696
                    • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe
                      "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe"
                      10⤵
                      • Modifies WinLogon for persistence
                      • Executes dropped EXE
                      • Adds Run key to start application
                      • Suspicious use of WriteProcessMemory
                      PID:3232
                      • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                        "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                        11⤵
                        • Executes dropped EXE
                        PID:1784
                      • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe
                        "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe"
                        11⤵
                        • Executes dropped EXE
                        • Suspicious use of WriteProcessMemory
                        PID:1940
                        • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                          "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                          12⤵
                          • Executes dropped EXE
                          PID:5024
                        • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe
                          "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe"
                          12⤵
                          • Executes dropped EXE
                          PID:3568
                          • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                            "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                            13⤵
                            • Executes dropped EXE
                            PID:3212
                          • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe
                            "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe"
                            13⤵
                            • Checks computer location settings
                            • Executes dropped EXE
                            PID:4272
                            • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                              "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                              14⤵
                              • Executes dropped EXE
                              PID:3748
                            • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe
                              "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe"
                              14⤵
                              • Checks computer location settings
                              • Executes dropped EXE
                              • Adds Run key to start application
                              • Drops file in System32 directory
                              PID:3760
                              • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                15⤵
                                • Executes dropped EXE
                                PID:1824
                              • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe
                                "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe"
                                15⤵
                                • Executes dropped EXE
                                PID:2976
                                • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                  "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                  16⤵
                                  • Executes dropped EXE
                                  PID:3240
                                • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe
                                  "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe"
                                  16⤵
                                  • Modifies WinLogon for persistence
                                  • Executes dropped EXE
                                  • Drops file in System32 directory
                                  • System Location Discovery: System Language Discovery
                                  PID:4832
                                  • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                    "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                    17⤵
                                    • Executes dropped EXE
                                    PID:2168
                                  • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe
                                    "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Adds Run key to start application
                                    • Drops file in System32 directory
                                    PID:2436
                                    • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                      "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                      18⤵
                                      • Executes dropped EXE
                                      • System Location Discovery: System Language Discovery
                                      PID:2328
                                    • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe
                                      "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe"
                                      18⤵
                                      • Executes dropped EXE
                                      • Adds Run key to start application
                                      PID:3944
                                      • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                        "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                        19⤵
                                        • Executes dropped EXE
                                        PID:1888
                                      • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe
                                        "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe"
                                        19⤵
                                        • Modifies WinLogon for persistence
                                        • Checks computer location settings
                                        • Executes dropped EXE
                                        • System Location Discovery: System Language Discovery
                                        PID:1264
                                        • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                          "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                          20⤵
                                          • Executes dropped EXE
                                          • System Location Discovery: System Language Discovery
                                          PID:3564
                                        • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe
                                          "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe"
                                          20⤵
                                          • Executes dropped EXE
                                          PID:2496
                                          • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                            "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                            21⤵
                                            • Executes dropped EXE
                                            PID:2888
                                          • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe
                                            "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe"
                                            21⤵
                                            • Modifies WinLogon for persistence
                                            • Checks computer location settings
                                            • Executes dropped EXE
                                            PID:4320
                                            • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                              "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                              22⤵
                                              • Executes dropped EXE
                                              PID:4932
                                            • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe
                                              "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe"
                                              22⤵
                                              • Executes dropped EXE
                                              PID:1664
                                              • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                23⤵
                                                • Executes dropped EXE
                                                PID:2732
                                              • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe
                                                "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe"
                                                23⤵
                                                • Modifies WinLogon for persistence
                                                • Checks computer location settings
                                                • Executes dropped EXE
                                                • Adds Run key to start application
                                                • Drops file in System32 directory
                                                PID:5084
                                                • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                  "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                  24⤵
                                                  • Executes dropped EXE
                                                  PID:2788
                                                • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe
                                                  "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe"
                                                  24⤵
                                                  • Checks computer location settings
                                                  • Executes dropped EXE
                                                  • Adds Run key to start application
                                                  PID:992
                                                  • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                    "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    PID:1232
                                                  • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe
                                                    "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    PID:2544
                                                    • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                      "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                      26⤵
                                                      • Executes dropped EXE
                                                      PID:3012
                                                    • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe
                                                      "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe"
                                                      26⤵
                                                      • Checks computer location settings
                                                      • Executes dropped EXE
                                                      • System Location Discovery: System Language Discovery
                                                      PID:3964
                                                      • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                        "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        PID:1264
                                                      • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe
                                                        "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe"
                                                        27⤵
                                                        • Checks computer location settings
                                                        • Executes dropped EXE
                                                        • Adds Run key to start application
                                                        PID:2112
                                                        • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                          "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                          28⤵
                                                          • Executes dropped EXE
                                                          PID:4752
                                                        • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe
                                                          "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe"
                                                          28⤵
                                                          • Modifies WinLogon for persistence
                                                          • Executes dropped EXE
                                                          PID:4208
                                                          • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                            "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • System Location Discovery: System Language Discovery
                                                            PID:1256
                                                          • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe
                                                            "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe"
                                                            29⤵
                                                            • Checks computer location settings
                                                            • Executes dropped EXE
                                                            • Drops file in System32 directory
                                                            PID:1220
                                                            • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                              "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                              30⤵
                                                              • Executes dropped EXE
                                                              PID:1392
                                                            • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe
                                                              "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe"
                                                              30⤵
                                                              • Checks computer location settings
                                                              • Executes dropped EXE
                                                              • System Location Discovery: System Language Discovery
                                                              PID:3804
                                                              • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                PID:532
                                                              • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe
                                                                "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Drops file in System32 directory
                                                                PID:2500
                                                                • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                  "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                  32⤵
                                                                  • Executes dropped EXE
                                                                  PID:3948
                                                                • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe
                                                                  "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe"
                                                                  32⤵
                                                                  • Modifies WinLogon for persistence
                                                                  • Executes dropped EXE
                                                                  PID:752
                                                                  • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                    "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    PID:860
                                                                  • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe
                                                                    "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Adds Run key to start application
                                                                    PID:4348
                                                                    • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                      "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                      34⤵
                                                                        PID:868
                                                                      • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe
                                                                        "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe"
                                                                        34⤵
                                                                        • Adds Run key to start application
                                                                        PID:4908
                                                                        • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                          "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                          35⤵
                                                                            PID:1664
                                                                          • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe
                                                                            "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe"
                                                                            35⤵
                                                                            • Drops file in System32 directory
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:2904
                                                                            • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                              "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                              36⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:3112
                                                                            • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe
                                                                              "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe"
                                                                              36⤵
                                                                              • Drops file in System32 directory
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:4448
                                                                              • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                37⤵
                                                                                  PID:1396
                                                                                • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe
                                                                                  "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                  37⤵
                                                                                  • Modifies WinLogon for persistence
                                                                                  • Adds Run key to start application
                                                                                  PID:4520
                                                                                  • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                    "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                    38⤵
                                                                                      PID:4892
                                                                                    • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe
                                                                                      "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                      38⤵
                                                                                      • Drops file in System32 directory
                                                                                      PID:5080
                                                                                      • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                        "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                        39⤵
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        PID:2928
                                                                                      • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe
                                                                                        "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                        39⤵
                                                                                        • Checks computer location settings
                                                                                        • Adds Run key to start application
                                                                                        • Drops file in System32 directory
                                                                                        PID:3904
                                                                                        • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                          "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                          40⤵
                                                                                            PID:4192
                                                                                          • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe
                                                                                            "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                            40⤵
                                                                                            • Drops file in System32 directory
                                                                                            PID:1948
                                                                                            • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                              "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                              41⤵
                                                                                                PID:3252
                                                                                              • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                41⤵
                                                                                                • Modifies WinLogon for persistence
                                                                                                • Checks computer location settings
                                                                                                • Drops file in System32 directory
                                                                                                PID:4912
                                                                                                • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                  "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                  42⤵
                                                                                                    PID:1224
                                                                                                  • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                    "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                    42⤵
                                                                                                    • Checks computer location settings
                                                                                                    PID:2172
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                      43⤵
                                                                                                        PID:2536
                                                                                                      • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                        "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                        43⤵
                                                                                                        • Checks computer location settings
                                                                                                        • Drops file in System32 directory
                                                                                                        PID:4348
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                          "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                          44⤵
                                                                                                            PID:1912
                                                                                                          • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                            "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                            44⤵
                                                                                                            • Modifies WinLogon for persistence
                                                                                                            • Drops file in System32 directory
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            PID:5096
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                              "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                              45⤵
                                                                                                                PID:692
                                                                                                              • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                45⤵
                                                                                                                • Adds Run key to start application
                                                                                                                PID:1968
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                  46⤵
                                                                                                                    PID:4208
                                                                                                                  • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                    "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                    46⤵
                                                                                                                    • Adds Run key to start application
                                                                                                                    PID:1468
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                      47⤵
                                                                                                                        PID:4988
                                                                                                                      • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                        "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                        47⤵
                                                                                                                        • Checks computer location settings
                                                                                                                        PID:4292
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                          48⤵
                                                                                                                            PID:3960
                                                                                                                          • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                            "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                            48⤵
                                                                                                                            • Checks computer location settings
                                                                                                                            • Adds Run key to start application
                                                                                                                            PID:4336
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                              49⤵
                                                                                                                                PID:2504
                                                                                                                              • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                49⤵
                                                                                                                                  PID:912
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                    50⤵
                                                                                                                                      PID:712
                                                                                                                                    • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                      "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                      50⤵
                                                                                                                                      • Modifies WinLogon for persistence
                                                                                                                                      • Checks computer location settings
                                                                                                                                      • Adds Run key to start application
                                                                                                                                      PID:4092
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                        51⤵
                                                                                                                                          PID:220
                                                                                                                                        • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                          "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                          51⤵
                                                                                                                                          • Modifies WinLogon for persistence
                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                          PID:5096
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                            52⤵
                                                                                                                                              PID:752
                                                                                                                                            • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                              "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                              52⤵
                                                                                                                                              • Checks computer location settings
                                                                                                                                              • Drops file in System32 directory
                                                                                                                                              PID:3768
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                53⤵
                                                                                                                                                  PID:912
                                                                                                                                                • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                  "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                  53⤵
                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                  PID:2112
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                    54⤵
                                                                                                                                                      PID:584
                                                                                                                                                    • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                      "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                      54⤵
                                                                                                                                                      • Modifies WinLogon for persistence
                                                                                                                                                      • Checks computer location settings
                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                      PID:2472
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                        55⤵
                                                                                                                                                          PID:4044
                                                                                                                                                        • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                          "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                          55⤵
                                                                                                                                                            PID:4288
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                              56⤵
                                                                                                                                                                PID:116
                                                                                                                                                              • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                56⤵
                                                                                                                                                                • Modifies WinLogon for persistence
                                                                                                                                                                • Adds Run key to start application
                                                                                                                                                                PID:4592
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                  57⤵
                                                                                                                                                                    PID:2472
                                                                                                                                                                  • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                    "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                    57⤵
                                                                                                                                                                    • Modifies WinLogon for persistence
                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                    PID:1468
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                      58⤵
                                                                                                                                                                        PID:4528
                                                                                                                                                                      • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                        "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                        58⤵
                                                                                                                                                                        • Modifies WinLogon for persistence
                                                                                                                                                                        • Adds Run key to start application
                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                        PID:4692
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                          59⤵
                                                                                                                                                                            PID:1760
                                                                                                                                                                          • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                            "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                            59⤵
                                                                                                                                                                            • Adds Run key to start application
                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                            PID:2036
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                              60⤵
                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                              PID:3852
                                                                                                                                                                            • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                              "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                              60⤵
                                                                                                                                                                              • Adds Run key to start application
                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                              PID:1636
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                61⤵
                                                                                                                                                                                  PID:4344
                                                                                                                                                                                • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                  "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                  61⤵
                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                                                  PID:4288
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                    62⤵
                                                                                                                                                                                      PID:4692
                                                                                                                                                                                    • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                      "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                      62⤵
                                                                                                                                                                                      • Modifies WinLogon for persistence
                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                                                      PID:2188
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                        63⤵
                                                                                                                                                                                          PID:1468
                                                                                                                                                                                        • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                          "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                          63⤵
                                                                                                                                                                                          • Modifies WinLogon for persistence
                                                                                                                                                                                          • Adds Run key to start application
                                                                                                                                                                                          PID:1636
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                            64⤵
                                                                                                                                                                                              PID:4412
                                                                                                                                                                                            • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                              "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                              64⤵
                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                              PID:5128
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                65⤵
                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                PID:5204
                                                                                                                                                                                              • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                65⤵
                                                                                                                                                                                                • Adds Run key to start application
                                                                                                                                                                                                PID:5256
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                  66⤵
                                                                                                                                                                                                    PID:5340
                                                                                                                                                                                                  • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                    "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                    66⤵
                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                    PID:5396
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                      67⤵
                                                                                                                                                                                                        PID:5472
                                                                                                                                                                                                      • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                        "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                        67⤵
                                                                                                                                                                                                        • Modifies WinLogon for persistence
                                                                                                                                                                                                        PID:5532
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                          68⤵
                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                          PID:5608
                                                                                                                                                                                                        • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                          "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                          68⤵
                                                                                                                                                                                                          • Modifies WinLogon for persistence
                                                                                                                                                                                                          • Adds Run key to start application
                                                                                                                                                                                                          PID:5652
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                            69⤵
                                                                                                                                                                                                              PID:5740
                                                                                                                                                                                                            • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                              "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                              69⤵
                                                                                                                                                                                                                PID:5796
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                  70⤵
                                                                                                                                                                                                                    PID:5884
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                    "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                    70⤵
                                                                                                                                                                                                                    • Modifies WinLogon for persistence
                                                                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                                                                    PID:5940
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                      71⤵
                                                                                                                                                                                                                        PID:6024
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                        "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                        71⤵
                                                                                                                                                                                                                        • Modifies WinLogon for persistence
                                                                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                                        PID:6076
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                          72⤵
                                                                                                                                                                                                                            PID:4288
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                            "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                            72⤵
                                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                                            • Adds Run key to start application
                                                                                                                                                                                                                            PID:5156
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                              73⤵
                                                                                                                                                                                                                                PID:5160
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                73⤵
                                                                                                                                                                                                                                • Modifies WinLogon for persistence
                                                                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                                                PID:5128
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                  74⤵
                                                                                                                                                                                                                                    PID:5336
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                    "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                    74⤵
                                                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                                                                                    PID:5528
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                      75⤵
                                                                                                                                                                                                                                        PID:5576
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                        "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                        75⤵
                                                                                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                                                                                        PID:5664
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                          76⤵
                                                                                                                                                                                                                                            PID:5748
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                            "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                            76⤵
                                                                                                                                                                                                                                            • Modifies WinLogon for persistence
                                                                                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                            PID:5712
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                              77⤵
                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                              PID:5916
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                              "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                              77⤵
                                                                                                                                                                                                                                              • Modifies WinLogon for persistence
                                                                                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                                                                                              PID:5844
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                                78⤵
                                                                                                                                                                                                                                                  PID:6008
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                                  "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                                  78⤵
                                                                                                                                                                                                                                                  • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                  PID:6020
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                                    79⤵
                                                                                                                                                                                                                                                      PID:6140
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                                      "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                                      79⤵
                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                      PID:5240
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                                        80⤵
                                                                                                                                                                                                                                                          PID:5376
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                                          "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                                          80⤵
                                                                                                                                                                                                                                                          • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                                                                                          PID:5316
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                                            81⤵
                                                                                                                                                                                                                                                              PID:5324
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                                              "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                                              81⤵
                                                                                                                                                                                                                                                              • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                              PID:5636
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                                                82⤵
                                                                                                                                                                                                                                                                  PID:5688
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                                                  "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                                                  82⤵
                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                  PID:5680
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                                                    83⤵
                                                                                                                                                                                                                                                                      PID:5864
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                                                      "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                                                      83⤵
                                                                                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                                                                                                                                      PID:5820
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                                                        84⤵
                                                                                                                                                                                                                                                                          PID:5956
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                                                          "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                                                          84⤵
                                                                                                                                                                                                                                                                            PID:1220
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                                                              85⤵
                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                              PID:5280
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                                                              "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                                                              85⤵
                                                                                                                                                                                                                                                                                PID:3716
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                                                                  86⤵
                                                                                                                                                                                                                                                                                    PID:5624
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                                                                    "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                                                                    86⤵
                                                                                                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                                                                                                    PID:5316
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                                                                      87⤵
                                                                                                                                                                                                                                                                                        PID:3480
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                                                                        "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                                                                        87⤵
                                                                                                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                                                                                                        PID:5524
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                                                                          88⤵
                                                                                                                                                                                                                                                                                            PID:5732
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                                                                            "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                                                                            88⤵
                                                                                                                                                                                                                                                                                            • Adds Run key to start application
                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                            PID:5948
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                                                                              89⤵
                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                              PID:5844
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                                                                              "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                                                                              89⤵
                                                                                                                                                                                                                                                                                              • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                              • Adds Run key to start application
                                                                                                                                                                                                                                                                                              PID:6048
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                                                                                90⤵
                                                                                                                                                                                                                                                                                                  PID:5252
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                                                                                  "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                  90⤵
                                                                                                                                                                                                                                                                                                    PID:6020
                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                                                                                      91⤵
                                                                                                                                                                                                                                                                                                        PID:5456
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                                                                                        "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                        91⤵
                                                                                                                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                        PID:1124
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                                                                                          92⤵
                                                                                                                                                                                                                                                                                                            PID:5568
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                                                                                            "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                            92⤵
                                                                                                                                                                                                                                                                                                            • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                                                                                                                            PID:5664
                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                                                                                              93⤵
                                                                                                                                                                                                                                                                                                                PID:5944
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                93⤵
                                                                                                                                                                                                                                                                                                                  PID:5964
                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                                                                                                    94⤵
                                                                                                                                                                                                                                                                                                                      PID:4568
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                      "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                      94⤵
                                                                                                                                                                                                                                                                                                                        PID:6076
                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                                                                                                          95⤵
                                                                                                                                                                                                                                                                                                                            PID:6048
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                            "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                            95⤵
                                                                                                                                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                            PID:5588
                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                                                                                                              96⤵
                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                              PID:5288
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                              "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                              96⤵
                                                                                                                                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                                                                                                                                              • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                              PID:2700
                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                                                                                                                97⤵
                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                PID:5668
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                97⤵
                                                                                                                                                                                                                                                                                                                                  PID:6012
                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                                                                                                                    98⤵
                                                                                                                                                                                                                                                                                                                                      PID:4376
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                      98⤵
                                                                                                                                                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                      PID:4104
                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                                                                                                                        99⤵
                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                        PID:5820
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                        "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                        99⤵
                                                                                                                                                                                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                        PID:5508
                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                                                                                                                          100⤵
                                                                                                                                                                                                                                                                                                                                            PID:948
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                            100⤵
                                                                                                                                                                                                                                                                                                                                              PID:5132
                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                                                                                                                                101⤵
                                                                                                                                                                                                                                                                                                                                                  PID:5284
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                  101⤵
                                                                                                                                                                                                                                                                                                                                                  • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                  PID:5420
                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                                                                                                                                    102⤵
                                                                                                                                                                                                                                                                                                                                                      PID:6020
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                      102⤵
                                                                                                                                                                                                                                                                                                                                                      • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                      PID:5384
                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                                                                                                                                        103⤵
                                                                                                                                                                                                                                                                                                                                                          PID:5968
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                          103⤵
                                                                                                                                                                                                                                                                                                                                                          • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                          PID:1556
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                                                                                                                                            104⤵
                                                                                                                                                                                                                                                                                                                                                              PID:548
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                              104⤵
                                                                                                                                                                                                                                                                                                                                                              • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                              PID:5964
                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                                                                                                                                                105⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:2052
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                  105⤵
                                                                                                                                                                                                                                                                                                                                                                  • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                  PID:1572
                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                                                                                                                                                    106⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:5516
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                      106⤵
                                                                                                                                                                                                                                                                                                                                                                      • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                      PID:5240
                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                                                                                                                                                        107⤵
                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                        PID:1080
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                        107⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:5564
                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                                                                                                                                                            108⤵
                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                            PID:5772
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                            108⤵
                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                            PID:2488
                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                                                                                                                                                              109⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:4200
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                109⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:2392
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                                                                                                                                                                    110⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:5656
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                      110⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                      PID:4104
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                                                                                                                                                                        111⤵
                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                        PID:2252
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                        111⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                        PID:2208
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                                                                                                                                                                          112⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:3732
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                            112⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                            PID:232
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                                                                                                                                                                              113⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:2956
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                113⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                PID:5364
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                  114⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                  PID:5468
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                  114⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                  PID:4000
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                    115⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:2208
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                      115⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:1768
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                          116⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:2204
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                            116⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                            PID:5444
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                              117⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:3360
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                117⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                                PID:2192
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                  118⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5044
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                    118⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3760
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                      119⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2488
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                        119⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5928
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                            120⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1684
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                              120⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:340
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                121⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2976
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                  121⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3224
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                      122⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4984
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                        122⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5460
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                          123⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1996
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                            123⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4260
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                              124⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2880
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                              124⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3992
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                125⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2340
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                  125⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4280
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                    126⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5140
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                      126⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5128
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                        127⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5428
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                          127⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4408
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                            128⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4580
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                              128⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:244
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                129⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5128
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  129⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5008
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    130⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5564
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    130⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:376
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      131⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3100
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        131⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1372
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          132⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5736
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            132⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6156
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                133⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6244
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  133⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6292
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    134⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6364
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      134⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6428
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        135⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6496
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          135⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6556
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            136⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6620
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              136⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6676
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                137⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6760
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  137⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6812
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      138⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6876
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        138⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6956
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          139⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:7020
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            139⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:7088
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              140⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:7156
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                140⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5008
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    141⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6232
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    141⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6312
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      142⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6408
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        142⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6292
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          143⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6572
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            143⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6696
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              144⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                144⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:7048
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  145⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:7008
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    145⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2140
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      146⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4408
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        146⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6156
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          147⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6788
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          147⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6464
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            148⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6832
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              148⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6428
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                149⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6900
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  149⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:7052
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      150⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6384
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        150⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6192
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          151⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6540
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            151⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2432
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                152⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  152⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:7076
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    153⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6524
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      153⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6660
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        154⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6568
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        154⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5212
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          155⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:7152
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            155⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6360
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                156⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6216
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  156⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3404
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    157⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6908
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      157⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6856
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        158⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6752
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          158⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5196
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            159⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:7072
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            159⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:7012
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              160⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:7064
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                160⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6448
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  161⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:7148
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    161⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5488
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      162⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5920
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        162⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6672
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            163⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6892
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              163⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1496
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                164⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6192
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  164⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6352
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    165⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6164
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      165⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:7532
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        166⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:7596
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          166⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:7668
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            167⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:7732
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              167⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:7804
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  168⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:7868
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    168⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:7936
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      169⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:8000
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        169⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:8056
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            170⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:8120
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              170⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:8180
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  171⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:7540
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  171⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5644
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:7588
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:7716
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:7896
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:7808
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:8044
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:8068
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:8176
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2388
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:7620
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:7676
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:7572
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6016
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:7836
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:7960
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:8016
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:8080
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1176
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4784
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:7652
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:7756
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:7728
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:7944
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:7680
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:8032
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:7948
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5168
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6312
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1992
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:7512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5940
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5632
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5708
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:7828
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2476
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1788
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4148
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:8152
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:7792
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5604
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:7656
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3740
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6160
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:7760
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:7856
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:8032
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:8184
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:7956
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:8096
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3248
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1096
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:8080
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:7796
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2364
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\system32\MSDCSC\DsZMSnRUvhJQ\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3720
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:8128

                                                                                                                                                                                                                                                                                                                                                            Network

                                                                                                                                                                                                                                                                                                                                                            MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                                                                                                                            Replay Monitor

                                                                                                                                                                                                                                                                                                                                                            Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                            Downloads

                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              17KB

                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                              586525dee240c296c88746096e618167

                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                              84dbddd71d7a524a47a84b53e8deaa84eacc2986

                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                              d426c6b7f88816879181f7dc3af2dc702fafb89e7590c6d508857845e16a1ba5

                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                              2a4692087feac144ea87a03dcf6eb4431c499a743eab207f4c6b79a7103249a3095f5b2a0d99ec11bbfd9c0d0f04548577e89905d68a6e25447839e0d910ac47

                                                                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              271KB

                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                              6945bd739beed82362cab7342482f7e9

                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                              a2a2e05ab1e1763b95eba9cc724e85cd9da9888a

                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                              ba78976847aea3bb9aa90e0d5ff6b70f871705f6c509357a5442325b5f013668

                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                              bf6bedbe7dcb2d5093367200f27404a3d565966245bfe2e38de111ef7b4401602351b6b19b4f54f3901430dea0d5f0b1b0b86d14b12de3a0616d695a82d5a19f

                                                                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                                                                            • memory/388-26-0x0000000002160000-0x0000000002161000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                            • memory/388-42-0x0000000000400000-0x00000000004C0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              768KB

                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                            • memory/404-129-0x0000000000400000-0x000000000040F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              60KB

                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                            • memory/692-717-0x0000000000400000-0x000000000040F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              60KB

                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                            • memory/752-532-0x0000000000400000-0x00000000004C0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              768KB

                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                            • memory/788-181-0x0000000000400000-0x000000000040F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              60KB

                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                            • memory/860-602-0x0000000000400000-0x000000000040F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              60KB

                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                            • memory/868-618-0x0000000000400000-0x000000000040F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              60KB

                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                            • memory/992-405-0x0000000000400000-0x00000000004C0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              768KB

                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                            • memory/1220-467-0x0000000000400000-0x00000000004C0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              768KB

                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                            • memory/1220-483-0x0000000000400000-0x00000000004C0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              768KB

                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                            • memory/1224-740-0x0000000000400000-0x000000000040F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              60KB

                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                            • memory/1232-471-0x0000000000400000-0x000000000040F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              60KB

                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                            • memory/1256-536-0x0000000000400000-0x000000000040F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              60KB

                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                            • memory/1264-322-0x0000000000400000-0x00000000004C0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              768KB

                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                            • memory/1264-314-0x0000000000400000-0x00000000004C0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              768KB

                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                            • memory/1264-505-0x0000000000400000-0x000000000040F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              60KB

                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                            • memory/1364-73-0x0000000000400000-0x00000000004C0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              768KB

                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                            • memory/1392-553-0x0000000000400000-0x000000000040F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              60KB

                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                            • memory/1396-665-0x0000000000400000-0x000000000040F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              60KB

                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                            • memory/1396-586-0x0000000000400000-0x000000000040F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              60KB

                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                            • memory/1468-750-0x0000000000400000-0x00000000004C0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              768KB

                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                            • memory/1664-634-0x0000000000400000-0x000000000040F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              60KB

                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                            • memory/1664-376-0x0000000000400000-0x00000000004C0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              768KB

                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                            • memory/1784-249-0x0000000000400000-0x000000000040F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              60KB

                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                            • memory/1824-318-0x0000000000400000-0x000000000040F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              60KB

                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                            • memory/1848-58-0x0000000000400000-0x00000000004C0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              768KB

                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                            • memory/1864-146-0x0000000000400000-0x000000000040F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              60KB

                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                            • memory/1888-380-0x0000000000400000-0x000000000040F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              60KB

                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                            • memory/1940-173-0x0000000000400000-0x00000000004C0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              768KB

                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                            • memory/1940-191-0x0000000000400000-0x00000000004C0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              768KB

                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                            • memory/1948-661-0x0000000000400000-0x00000000004C0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              768KB

                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                            • memory/1968-736-0x0000000000400000-0x00000000004C0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              768KB

                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                            • memory/2112-450-0x0000000000400000-0x00000000004C0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              768KB

                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                            • memory/2168-346-0x0000000000400000-0x000000000040F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              60KB

                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                            • memory/2172-695-0x0000000000400000-0x00000000004C0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              768KB

                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                            • memory/2328-365-0x0000000000400000-0x000000000040F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              60KB

                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                            • memory/2436-297-0x0000000000400000-0x00000000004C0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              768KB

                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                            • memory/2496-339-0x0000000000400000-0x00000000004C0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              768KB

                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                            • memory/2500-516-0x0000000000400000-0x00000000004C0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              768KB

                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                            • memory/2500-500-0x0000000000400000-0x00000000004C0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              768KB

                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                            • memory/2544-140-0x0000000000400000-0x00000000004C0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              768KB

                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                            • memory/2544-419-0x0000000000400000-0x00000000004C0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              768KB

                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                            • memory/2580-90-0x0000000000400000-0x00000000004C0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              768KB

                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                            • memory/2732-438-0x0000000000400000-0x000000000040F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              60KB

                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                            • memory/2788-454-0x0000000000400000-0x000000000040F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              60KB

                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                            • memory/2904-580-0x0000000000400000-0x00000000004C0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              768KB

                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                            • memory/2928-699-0x0000000000400000-0x000000000040F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              60KB

                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                            • memory/2976-261-0x0000000000400000-0x00000000004C0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              768KB

                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                            • memory/3012-487-0x0000000000400000-0x000000000040F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              60KB

                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                            • memory/3060-197-0x0000000000400000-0x000000000040F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              60KB

                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                            • memory/3080-123-0x0000000000400000-0x00000000004C0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              768KB

                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                            • memory/3092-214-0x0000000000400000-0x000000000040F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              60KB

                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                            • memory/3112-649-0x0000000000400000-0x000000000040F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              60KB

                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                            • memory/3180-163-0x0000000000400000-0x000000000040F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              60KB

                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                            • memory/3212-285-0x0000000000400000-0x000000000040F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              60KB

                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                            • memory/3216-106-0x0000000000400000-0x00000000004C0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              768KB

                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                            • memory/3224-1-0x00000000024C0000-0x00000000024C1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                            • memory/3224-0-0x0000000000400000-0x00000000004C0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              768KB

                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                            • memory/3224-25-0x0000000000400000-0x00000000004C0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              768KB

                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                            • memory/3232-175-0x0000000000400000-0x00000000004C0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              768KB

                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                            • memory/3240-328-0x0000000000400000-0x000000000040F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              60KB

                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                            • memory/3252-725-0x0000000000400000-0x000000000040F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              60KB

                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                            • memory/3564-394-0x0000000000400000-0x000000000040F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              60KB

                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                            • memory/3568-208-0x0000000000400000-0x00000000004C0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              768KB

                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                            • memory/3696-231-0x0000000000400000-0x000000000040F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              60KB

                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                            • memory/3748-303-0x0000000000400000-0x000000000040F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              60KB

                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                            • memory/3752-88-0x0000000000400000-0x000000000040F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              60KB

                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                            • memory/3752-12-0x0000000000400000-0x000000000040F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              60KB

                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                            • memory/3760-243-0x0000000000400000-0x00000000004C0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              768KB

                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                            • memory/3804-497-0x0000000000400000-0x00000000004C0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              768KB

                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                            • memory/3904-645-0x0000000000400000-0x00000000004C0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              768KB

                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                            • memory/3944-316-0x0000000000400000-0x00000000004C0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              768KB

                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                            • memory/3964-434-0x0000000000400000-0x00000000004C0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              768KB

                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                            • memory/4192-716-0x0000000000400000-0x000000000040F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              60KB

                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                            • memory/4208-465-0x0000000000400000-0x00000000004C0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              768KB

                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                            • memory/4272-225-0x0000000000400000-0x00000000004C0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              768KB

                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                            • memory/4276-112-0x0000000000400000-0x000000000040F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              60KB

                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                            • memory/4320-358-0x0000000000400000-0x00000000004C0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              768KB

                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                            • memory/4348-713-0x0000000000400000-0x00000000004C0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              768KB

                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                            • memory/4348-549-0x0000000000400000-0x00000000004C0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              768KB

                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                            • memory/4428-157-0x0000000000400000-0x00000000004C0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              768KB

                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                            • memory/4448-597-0x0000000000400000-0x00000000004C0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              768KB

                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                            • memory/4448-581-0x0000000000400000-0x00000000004C0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              768KB

                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                            • memory/4520-613-0x0000000000400000-0x00000000004C0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              768KB

                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                            • memory/4752-520-0x0000000000400000-0x000000000040F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              60KB

                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                            • memory/4752-439-0x0000000000400000-0x000000000040F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              60KB

                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                            • memory/4832-279-0x0000000000400000-0x00000000004C0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              768KB

                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                            • memory/4892-682-0x0000000000400000-0x000000000040F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              60KB

                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                            • memory/4908-565-0x0000000000400000-0x00000000004C0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              768KB

                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                            • memory/4912-678-0x0000000000400000-0x00000000004C0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              768KB

                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                            • memory/4932-347-0x0000000000400000-0x000000000040F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              60KB

                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                            • memory/4932-423-0x0000000000400000-0x000000000040F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              60KB

                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                            • memory/5024-267-0x0000000000400000-0x000000000040F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              60KB

                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                            • memory/5080-629-0x0000000000400000-0x00000000004C0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              768KB

                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                            • memory/5084-389-0x0000000000400000-0x00000000004C0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              768KB

                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                            • memory/5096-711-0x0000000000400000-0x00000000004C0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              768KB

                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                            • memory/5096-720-0x0000000000400000-0x00000000004C0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                              768KB

                                                                                                                                                                                                                                                                                                                                                              Download