e776bac009401a8690377b7b49ba6ff61aea4eea48e1d3f208284556292fefc3

Analysis

max time kernel
126s
max time network
128s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01/10/2024, 20:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

074c415b7ff6216759269472e63ef44d_JaffaCakes118.exe
Size

73KB
MD5

074c415b7ff6216759269472e63ef44d
SHA1

238dfa827dcaa7ac3f48d30909abd20ecfedbb8e
SHA256

e776bac009401a8690377b7b49ba6ff61aea4eea48e1d3f208284556292fefc3
SHA512

8b93a53a7620a069ac046484f6c3ace792a8e83b6425d90de4b582f03d2dae3d2e531754708d4d7b9e2b5189b070f734cba9f43f084d11fd6615d5c9cb4ff81b
SSDEEP

1536:81z9+RskvxHkV3dDivpPpfl/WZD8bWdjyv4NXuuSY5T3:y9+Rsk54tclll/RbWtyv49V3

Score

8^/10

discovery persistence

Malware Config

Signatures

Adds policy Run key to start application 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	wcsydrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	wcsydrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	wcsydrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	wcsydrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	wcsydrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	wcsydrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	wcsydrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	wcsydrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	wcsydrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	wcsydrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	wcsydrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	wcsydrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	wcsydrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	wcsydrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	wcsydrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	wcsydrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	wcsydrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	wcsydrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	wcsydrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	wcsydrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	wcsydrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	wcsydrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	wcsydrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	wcsydrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	wcsydrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	wcsydrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	wcsydrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	wcsydrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	wcsydrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	wcsydrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	wcsydrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	wcsydrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	wcsydrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	wcsydrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	wcsydrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	wcsydrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	wcsydrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	wcsydrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	wcsydrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	wcsydrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	wcsydrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	wcsydrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	wcsydrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	wcsydrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	wcsydrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	wcsydrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	wcsydrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	wcsydrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	wcsydrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	wcsydrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	wcsydrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	wcsydrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	wcsydrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	wcsydrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	wcsydrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	wcsydrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	wcsydrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	wcsydrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	wcsydrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	wcsydrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	wcsydrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	wcsydrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	wcsydrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	wcsydrv.exe

Executes dropped EXE 64 IoCs

pid	Process
3024	wcsydrv.exe
3052	wcsydrv.exe
2756	wcsydrv.exe
2672	wcsydrv.exe
2976	wcsydrv.exe
2660	wcsydrv.exe
2496	wcsydrv.exe
2556	wcsydrv.exe
2960	wcsydrv.exe
2304	wcsydrv.exe
1324	wcsydrv.exe
1508	wcsydrv.exe
1876	wcsydrv.exe
2348	wcsydrv.exe
2912	wcsydrv.exe
1640	wcsydrv.exe
2808	wcsydrv.exe
1156	wcsydrv.exe
608	wcsydrv.exe
2688	wcsydrv.exe
2396	wcsydrv.exe
2040	wcsydrv.exe
1036	wcsydrv.exe
2460	wcsydrv.exe
2028	wcsydrv.exe
760	wcsydrv.exe
2052	wcsydrv.exe
2252	wcsydrv.exe
2248	wcsydrv.exe
2576	wcsydrv.exe
2192	wcsydrv.exe
2412	wcsydrv.exe
2916	wcsydrv.exe
2316	wcsydrv.exe
944	wcsydrv.exe
1684	wcsydrv.exe
1596	wcsydrv.exe
2400	wcsydrv.exe
892	wcsydrv.exe
1960	wcsydrv.exe
1316	wcsydrv.exe
1088	wcsydrv.exe
1544	wcsydrv.exe
1776	wcsydrv.exe
824	wcsydrv.exe
1792	wcsydrv.exe
1048	wcsydrv.exe
588	wcsydrv.exe
2324	wcsydrv.exe
2072	wcsydrv.exe
1912	wcsydrv.exe
2288	wcsydrv.exe
1652	wcsydrv.exe
1944	wcsydrv.exe
1888	wcsydrv.exe
360	wcsydrv.exe
864	wcsydrv.exe
1732	wcsydrv.exe
2296	wcsydrv.exe
2700	wcsydrv.exe
2596	wcsydrv.exe
2764	wcsydrv.exe
2648	wcsydrv.exe
2624	wcsydrv.exe

Loads dropped DLL 64 IoCs

pid	Process
2728	074c415b7ff6216759269472e63ef44d_JaffaCakes118.exe
2728	074c415b7ff6216759269472e63ef44d_JaffaCakes118.exe
3024	wcsydrv.exe
3052	wcsydrv.exe
2756	wcsydrv.exe
2672	wcsydrv.exe
2976	wcsydrv.exe
2660	wcsydrv.exe
2496	wcsydrv.exe
2556	wcsydrv.exe
2960	wcsydrv.exe
2304	wcsydrv.exe
1324	wcsydrv.exe
1508	wcsydrv.exe
1876	wcsydrv.exe
2348	wcsydrv.exe
2912	wcsydrv.exe
1640	wcsydrv.exe
2808	wcsydrv.exe
1156	wcsydrv.exe
608	wcsydrv.exe
2688	wcsydrv.exe
2396	wcsydrv.exe
2040	wcsydrv.exe
1036	wcsydrv.exe
2460	wcsydrv.exe
2028	wcsydrv.exe
760	wcsydrv.exe
2052	wcsydrv.exe
2252	wcsydrv.exe
2248	wcsydrv.exe
2576	wcsydrv.exe
2192	wcsydrv.exe
2412	wcsydrv.exe
2916	wcsydrv.exe
2316	wcsydrv.exe
944	wcsydrv.exe
1684	wcsydrv.exe
1596	wcsydrv.exe
2400	wcsydrv.exe
892	wcsydrv.exe
1960	wcsydrv.exe
1316	wcsydrv.exe
1088	wcsydrv.exe
1544	wcsydrv.exe
1776	wcsydrv.exe
824	wcsydrv.exe
1792	wcsydrv.exe
1048	wcsydrv.exe
588	wcsydrv.exe
2324	wcsydrv.exe
2072	wcsydrv.exe
1912	wcsydrv.exe
2288	wcsydrv.exe
1652	wcsydrv.exe
1944	wcsydrv.exe
1888	wcsydrv.exe
360	wcsydrv.exe
864	wcsydrv.exe
1732	wcsydrv.exe
2296	wcsydrv.exe
2700	wcsydrv.exe
2596	wcsydrv.exe
2764	wcsydrv.exe

Adds Run key to start application 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Services Data = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wcsydrv.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Services Data = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wcsydrv.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Windows Services Data = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wcsydrv.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Services Data = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wcsydrv.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Windows Services Data = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wcsydrv.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Windows Services Data = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wcsydrv.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Services Data = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wcsydrv.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Services Data = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wcsydrv.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Services Data = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wcsydrv.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Windows Services Data = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wcsydrv.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Services Data = "C:\\Users\\Admin\\AppData\\Local\\Temp\\074c415b7ff6216759269472e63ef44d_JaffaCakes118.exe"	074c415b7ff6216759269472e63ef44d_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Windows Services Data = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wcsydrv.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Windows Services Data = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wcsydrv.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Services Data = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wcsydrv.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Services Data = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wcsydrv.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Windows Services Data = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wcsydrv.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Windows Services Data = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wcsydrv.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Services Data = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wcsydrv.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Windows Services Data = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wcsydrv.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Windows Services Data = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wcsydrv.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Windows Services Data = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wcsydrv.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Services Data = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wcsydrv.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Services Data = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wcsydrv.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Services Data = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wcsydrv.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Windows Services Data = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wcsydrv.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Windows Services Data = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wcsydrv.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Services Data = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wcsydrv.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Windows Services Data = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wcsydrv.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Services Data = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wcsydrv.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Services Data = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wcsydrv.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Windows Services Data = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wcsydrv.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Windows Services Data = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wcsydrv.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Services Data = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wcsydrv.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Windows Services Data = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wcsydrv.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Services Data = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wcsydrv.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Windows Services Data = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wcsydrv.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Windows Services Data = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wcsydrv.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Windows Services Data = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wcsydrv.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Windows Services Data = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wcsydrv.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Windows Services Data = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wcsydrv.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Services Data = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wcsydrv.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Windows Services Data = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wcsydrv.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Services Data = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wcsydrv.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Services Data = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wcsydrv.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Windows Services Data = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wcsydrv.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Windows Services Data = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wcsydrv.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Windows Services Data = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wcsydrv.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Windows Services Data = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wcsydrv.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Windows Services Data = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wcsydrv.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Windows Services Data = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wcsydrv.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Windows Services Data = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wcsydrv.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Services Data = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wcsydrv.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Windows Services Data = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wcsydrv.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Services Data = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wcsydrv.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Services Data = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wcsydrv.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Windows Services Data = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wcsydrv.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Services Data = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wcsydrv.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Windows Services Data = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wcsydrv.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Services Data = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wcsydrv.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Windows Services Data = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wcsydrv.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Windows Services Data = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wcsydrv.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Services Data = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wcsydrv.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Services Data = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wcsydrv.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Services Data = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wcsydrv.exe"	wcsydrv.exe

Modifies WinLogon 2 TTPs 64 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Windows start = "explorer.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Windows start = "explorer.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Windows start = "explorer.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Windows start = "explorer.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Windows start = "explorer.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Windows start = "explorer.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Windows start = "explorer.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Windows start = "explorer.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Windows start = "explorer.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Windows start = "explorer.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Windows start = "explorer.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Windows start = "explorer.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Windows start = "explorer.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Windows start = "explorer.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Windows start = "explorer.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Windows start = "explorer.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Windows start = "explorer.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Windows start = "explorer.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Windows start = "explorer.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Windows start = "explorer.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Windows start = "explorer.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Windows start = "explorer.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Windows start = "explorer.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Windows start = "explorer.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Windows start = "explorer.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Windows start = "explorer.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Windows start = "explorer.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Windows start = "explorer.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Windows start = "explorer.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Windows start = "explorer.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Windows start = "explorer.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Windows start = "explorer.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Windows start = "explorer.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Windows start = "explorer.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Windows start = "explorer.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Windows start = "explorer.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Windows start = "explorer.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Windows start = "explorer.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Windows start = "explorer.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Windows start = "explorer.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Windows start = "explorer.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Windows start = "explorer.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Windows start = "explorer.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Windows start = "explorer.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Windows start = "explorer.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Windows start = "explorer.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Windows start = "explorer.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Windows start = "explorer.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Windows start = "explorer.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Windows start = "explorer.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Windows start = "explorer.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Windows start = "explorer.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Windows start = "explorer.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Windows start = "explorer.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Windows start = "explorer.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Windows start = "explorer.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Windows start = "explorer.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Windows start = "explorer.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Windows start = "explorer.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Windows start = "explorer.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Windows start = "explorer.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Windows start = "explorer.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Windows start = "explorer.exe"	wcsydrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Windows start = "explorer.exe"	wcsydrv.exe

Suspicious use of SetThreadContext 64 IoCs

description	pid	Process	procid_target
PID 2700 set thread context of 2728	2700	074c415b7ff6216759269472e63ef44d_JaffaCakes118.exe	30
PID 3024 set thread context of 3052	3024	wcsydrv.exe	32
PID 2756 set thread context of 2672	2756	wcsydrv.exe	34
PID 2976 set thread context of 2660	2976	wcsydrv.exe	36
PID 2496 set thread context of 2556	2496	wcsydrv.exe	38
PID 2960 set thread context of 2304	2960	wcsydrv.exe	40
PID 1324 set thread context of 1508	1324	wcsydrv.exe	42
PID 1876 set thread context of 2348	1876	wcsydrv.exe	44
PID 2912 set thread context of 1640	2912	wcsydrv.exe	46
PID 2808 set thread context of 1156	2808	wcsydrv.exe	48
PID 608 set thread context of 2688	608	wcsydrv.exe	50
PID 2396 set thread context of 2040	2396	wcsydrv.exe	52
PID 1036 set thread context of 2460	1036	wcsydrv.exe	54
PID 2028 set thread context of 760	2028	wcsydrv.exe	56
PID 2052 set thread context of 2252	2052	wcsydrv.exe	58
PID 2248 set thread context of 2576	2248	wcsydrv.exe	60
PID 2192 set thread context of 2412	2192	wcsydrv.exe	62
PID 2916 set thread context of 2316	2916	wcsydrv.exe	64
PID 944 set thread context of 1684	944	wcsydrv.exe	66
PID 1596 set thread context of 2400	1596	wcsydrv.exe	68
PID 892 set thread context of 1960	892	wcsydrv.exe	70
PID 1316 set thread context of 1088	1316	wcsydrv.exe	72
PID 1544 set thread context of 1776	1544	wcsydrv.exe	74
PID 824 set thread context of 1792	824	wcsydrv.exe	76
PID 1048 set thread context of 588	1048	wcsydrv.exe	78
PID 2324 set thread context of 2072	2324	wcsydrv.exe	80
PID 1912 set thread context of 2288	1912	wcsydrv.exe	82
PID 1652 set thread context of 1944	1652	wcsydrv.exe	84
PID 1888 set thread context of 360	1888	wcsydrv.exe	86
PID 864 set thread context of 1732	864	wcsydrv.exe	88
PID 2296 set thread context of 2700	2296	wcsydrv.exe	90
PID 2596 set thread context of 2764	2596	wcsydrv.exe	92
PID 2648 set thread context of 2624	2648	wcsydrv.exe	94
PID 2320 set thread context of 2616	2320	wcsydrv.exe	96
PID 2732 set thread context of 2852	2732	wcsydrv.exe	98
PID 2176 set thread context of 2844	2176	wcsydrv.exe	100
PID 2672 set thread context of 2664	2672	wcsydrv.exe	102
PID 2508 set thread context of 2548	2508	wcsydrv.exe	104
PID 2524 set thread context of 2964	2524	wcsydrv.exe	106
PID 2972 set thread context of 2128	2972	wcsydrv.exe	108
PID 2968 set thread context of 2476	2968	wcsydrv.exe	110
PID 1764 set thread context of 428	1764	wcsydrv.exe	112
PID 2224 set thread context of 1876	2224	wcsydrv.exe	114
PID 2904 set thread context of 1192	2904	wcsydrv.exe	116
PID 564 set thread context of 572	564	wcsydrv.exe	118
PID 2808 set thread context of 1252	2808	wcsydrv.exe	120
PID 2480 set thread context of 2020	2480	wcsydrv.exe	122
PID 1360 set thread context of 2404	1360	wcsydrv.exe	124
PID 1144 set thread context of 1968	1144	wcsydrv.exe	126
PID 1060 set thread context of 2168	1060	wcsydrv.exe	128
PID 264 set thread context of 1984	264	wcsydrv.exe	130
PID 760 set thread context of 2372	760	wcsydrv.exe	132
PID 1716 set thread context of 2116	1716	wcsydrv.exe	134
PID 2920 set thread context of 2772	2920	wcsydrv.exe	136
PID 2576 set thread context of 2996	2576	wcsydrv.exe	138
PID 2924 set thread context of 2572	2924	wcsydrv.exe	140
PID 1696 set thread context of 1188	1696	wcsydrv.exe	142
PID 1312 set thread context of 948	1312	wcsydrv.exe	144
PID 1468 set thread context of 1132	1468	wcsydrv.exe	146
PID 1592 set thread context of 1476	1592	wcsydrv.exe	148
PID 1800 set thread context of 816	1800	wcsydrv.exe	150
PID 1632 set thread context of 1536	1632	wcsydrv.exe	152
PID 1976 set thread context of 1472	1976	wcsydrv.exe	154
PID 1532 set thread context of 860	1532	wcsydrv.exe	156

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wcsydrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wcsydrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wcsydrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wcsydrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wcsydrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wcsydrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wcsydrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wcsydrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wcsydrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wcsydrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wcsydrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wcsydrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wcsydrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wcsydrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wcsydrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wcsydrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wcsydrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wcsydrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wcsydrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wcsydrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	074c415b7ff6216759269472e63ef44d_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wcsydrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wcsydrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wcsydrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wcsydrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wcsydrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wcsydrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wcsydrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wcsydrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wcsydrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wcsydrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wcsydrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wcsydrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wcsydrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wcsydrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wcsydrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wcsydrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wcsydrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wcsydrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wcsydrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wcsydrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wcsydrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wcsydrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wcsydrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wcsydrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wcsydrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wcsydrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wcsydrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wcsydrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wcsydrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wcsydrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wcsydrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wcsydrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wcsydrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wcsydrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wcsydrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wcsydrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wcsydrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wcsydrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wcsydrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wcsydrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wcsydrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wcsydrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wcsydrv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2700 wrote to memory of 2728	2700	074c415b7ff6216759269472e63ef44d_JaffaCakes118.exe	30
PID 2700 wrote to memory of 2728	2700	074c415b7ff6216759269472e63ef44d_JaffaCakes118.exe	30
PID 2700 wrote to memory of 2728	2700	074c415b7ff6216759269472e63ef44d_JaffaCakes118.exe	30
PID 2700 wrote to memory of 2728	2700	074c415b7ff6216759269472e63ef44d_JaffaCakes118.exe	30
PID 2700 wrote to memory of 2728	2700	074c415b7ff6216759269472e63ef44d_JaffaCakes118.exe	30
PID 2700 wrote to memory of 2728	2700	074c415b7ff6216759269472e63ef44d_JaffaCakes118.exe	30
PID 2728 wrote to memory of 3024	2728	074c415b7ff6216759269472e63ef44d_JaffaCakes118.exe	31
PID 2728 wrote to memory of 3024	2728	074c415b7ff6216759269472e63ef44d_JaffaCakes118.exe	31
PID 2728 wrote to memory of 3024	2728	074c415b7ff6216759269472e63ef44d_JaffaCakes118.exe	31
PID 2728 wrote to memory of 3024	2728	074c415b7ff6216759269472e63ef44d_JaffaCakes118.exe	31
PID 3024 wrote to memory of 3052	3024	wcsydrv.exe	32
PID 3024 wrote to memory of 3052	3024	wcsydrv.exe	32
PID 3024 wrote to memory of 3052	3024	wcsydrv.exe	32
PID 3024 wrote to memory of 3052	3024	wcsydrv.exe	32
PID 3024 wrote to memory of 3052	3024	wcsydrv.exe	32
PID 3024 wrote to memory of 3052	3024	wcsydrv.exe	32
PID 3052 wrote to memory of 2756	3052	wcsydrv.exe	33
PID 3052 wrote to memory of 2756	3052	wcsydrv.exe	33
PID 3052 wrote to memory of 2756	3052	wcsydrv.exe	33
PID 3052 wrote to memory of 2756	3052	wcsydrv.exe	33
PID 2756 wrote to memory of 2672	2756	wcsydrv.exe	34
PID 2756 wrote to memory of 2672	2756	wcsydrv.exe	34
PID 2756 wrote to memory of 2672	2756	wcsydrv.exe	34
PID 2756 wrote to memory of 2672	2756	wcsydrv.exe	34
PID 2756 wrote to memory of 2672	2756	wcsydrv.exe	34
PID 2756 wrote to memory of 2672	2756	wcsydrv.exe	34
PID 2672 wrote to memory of 2976	2672	wcsydrv.exe	35
PID 2672 wrote to memory of 2976	2672	wcsydrv.exe	35
PID 2672 wrote to memory of 2976	2672	wcsydrv.exe	35
PID 2672 wrote to memory of 2976	2672	wcsydrv.exe	35
PID 2976 wrote to memory of 2660	2976	wcsydrv.exe	36
PID 2976 wrote to memory of 2660	2976	wcsydrv.exe	36
PID 2976 wrote to memory of 2660	2976	wcsydrv.exe	36
PID 2976 wrote to memory of 2660	2976	wcsydrv.exe	36
PID 2976 wrote to memory of 2660	2976	wcsydrv.exe	36
PID 2976 wrote to memory of 2660	2976	wcsydrv.exe	36
PID 2660 wrote to memory of 2496	2660	wcsydrv.exe	37
PID 2660 wrote to memory of 2496	2660	wcsydrv.exe	37
PID 2660 wrote to memory of 2496	2660	wcsydrv.exe	37
PID 2660 wrote to memory of 2496	2660	wcsydrv.exe	37
PID 2496 wrote to memory of 2556	2496	wcsydrv.exe	38
PID 2496 wrote to memory of 2556	2496	wcsydrv.exe	38
PID 2496 wrote to memory of 2556	2496	wcsydrv.exe	38
PID 2496 wrote to memory of 2556	2496	wcsydrv.exe	38
PID 2496 wrote to memory of 2556	2496	wcsydrv.exe	38
PID 2496 wrote to memory of 2556	2496	wcsydrv.exe	38
PID 2556 wrote to memory of 2960	2556	wcsydrv.exe	39
PID 2556 wrote to memory of 2960	2556	wcsydrv.exe	39
PID 2556 wrote to memory of 2960	2556	wcsydrv.exe	39
PID 2556 wrote to memory of 2960	2556	wcsydrv.exe	39
PID 2960 wrote to memory of 2304	2960	wcsydrv.exe	40
PID 2960 wrote to memory of 2304	2960	wcsydrv.exe	40
PID 2960 wrote to memory of 2304	2960	wcsydrv.exe	40
PID 2960 wrote to memory of 2304	2960	wcsydrv.exe	40
PID 2960 wrote to memory of 2304	2960	wcsydrv.exe	40
PID 2960 wrote to memory of 2304	2960	wcsydrv.exe	40
PID 2304 wrote to memory of 1324	2304	wcsydrv.exe	41
PID 2304 wrote to memory of 1324	2304	wcsydrv.exe	41
PID 2304 wrote to memory of 1324	2304	wcsydrv.exe	41
PID 2304 wrote to memory of 1324	2304	wcsydrv.exe	41
PID 1324 wrote to memory of 1508	1324	wcsydrv.exe	42
PID 1324 wrote to memory of 1508	1324	wcsydrv.exe	42
PID 1324 wrote to memory of 1508	1324	wcsydrv.exe	42
PID 1324 wrote to memory of 1508	1324	wcsydrv.exe	42

C:\Users\Admin\AppData\Local\Temp\074c415b7ff6216759269472e63ef44d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\074c415b7ff6216759269472e63ef44d_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2700
- C:\Users\Admin\AppData\Local\Temp\074c415b7ff6216759269472e63ef44d_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\074c415b7ff6216759269472e63ef44d_JaffaCakes118.exe
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2728
- - C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
    "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:3024
  - - C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
      C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:3052
    - - C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:2756
      - C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:2672
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:2976
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies WinLogon
        Suspicious use of WriteProcessMemory
        
        PID:2660
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        9⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:2496
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        10⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:2556
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        11⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:2960
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        12⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:2304
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        13⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:1324
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        14⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1508
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        15⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        
        PID:1876
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        16⤵
        Adds policy Run key to start application
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2348
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        17⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        
        PID:2912
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        18⤵
        Adds policy Run key to start application
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1640
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        19⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        
        PID:2808
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        20⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies WinLogon
        
        PID:1156
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        21⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        
        PID:608
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        22⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2688
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        23⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2396
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        24⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:2040
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        25⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        
        PID:1036
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        26⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2460
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        27⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2028
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        28⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies WinLogon
        System Location Discovery: System Language Discovery
        
        PID:760
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        29⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2052
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        30⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2252
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        31⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        
        PID:2248
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        32⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2576
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        33⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        
        PID:2192
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        34⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2412
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        35⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        
        PID:2916
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        36⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        
        PID:2316
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        37⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        
        PID:944
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        38⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        
        PID:1684
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        39⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        
        PID:1596
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        40⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2400
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        41⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        
        PID:892
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        42⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        
        PID:1960
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        43⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        
        PID:1316
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        44⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Modifies WinLogon
        
        PID:1088
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        45⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        
        PID:1544
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        46⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:1776
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        47⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        
        PID:824
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        48⤵
        Adds policy Run key to start application
        Executes dropped EXE
        Loads dropped DLL
        Modifies WinLogon
        
        PID:1792
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        49⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        
        PID:1048
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        50⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        
        PID:588
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        51⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        
        PID:2324
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        52⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2072
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        53⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        
        PID:1912
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        54⤵
        Adds policy Run key to start application
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Modifies WinLogon
        
        PID:2288
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        55⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        
        PID:1652
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        56⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Modifies WinLogon
        
        PID:1944
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        57⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        
        PID:1888
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        58⤵
        Adds policy Run key to start application
        Executes dropped EXE
        Loads dropped DLL
        Modifies WinLogon
        
        PID:360
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        59⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        
        PID:864
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        60⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Modifies WinLogon
        
        PID:1732
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        61⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        
        PID:2296
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        62⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies WinLogon
        
        PID:2700
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        63⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        
        PID:2596
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        64⤵
        Adds policy Run key to start application
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:2764
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        65⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2648
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        66⤵
        Executes dropped EXE
        
        PID:2624
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        67⤵
        Suspicious use of SetThreadContext
        
        PID:2320
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        68⤵
        Modifies WinLogon
        
        PID:2616
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        69⤵
        Suspicious use of SetThreadContext
        
        PID:2732
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        70⤵
        Adds Run key to start application
        
        PID:2852
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        71⤵
        Suspicious use of SetThreadContext
        
        PID:2176
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        72⤵
        Adds Run key to start application
        Modifies WinLogon
        
        PID:2844
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        73⤵
        Suspicious use of SetThreadContext
        
        PID:2672
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        74⤵
        Adds policy Run key to start application
        
        PID:2664
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        75⤵
        Suspicious use of SetThreadContext
        
        PID:2508
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        76⤵
        Adds policy Run key to start application
        Adds Run key to start application
        Modifies WinLogon
        System Location Discovery: System Language Discovery
        
        PID:2548
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        77⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2524
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        78⤵
        Adds Run key to start application
        
        PID:2964
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        79⤵
        Suspicious use of SetThreadContext
        
        PID:2972
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        80⤵
        Adds policy Run key to start application
        Modifies WinLogon
        System Location Discovery: System Language Discovery
        
        PID:2128
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        81⤵
        Suspicious use of SetThreadContext
        
        PID:2968
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        82⤵
        
        PID:2476
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        83⤵
        Suspicious use of SetThreadContext
        
        PID:1764
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        84⤵
        Adds Run key to start application
        
        PID:428
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        85⤵
        Suspicious use of SetThreadContext
        
        PID:2224
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        86⤵
        Adds policy Run key to start application
        
        PID:1876
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        87⤵
        Suspicious use of SetThreadContext
        
        PID:2904
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        88⤵
        
        PID:1192
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        89⤵
        Suspicious use of SetThreadContext
        
        PID:564
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        90⤵
        Adds policy Run key to start application
        Adds Run key to start application
        
        PID:572
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        91⤵
        Suspicious use of SetThreadContext
        
        PID:2808
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        92⤵
        Adds Run key to start application
        
        PID:1252
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        93⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2480
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        94⤵
        
        PID:2020
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        95⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1360
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        96⤵
        Adds policy Run key to start application
        
        PID:2404
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        97⤵
        Suspicious use of SetThreadContext
        
        PID:1144
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        98⤵
        Modifies WinLogon
        
        PID:1968
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        99⤵
        Suspicious use of SetThreadContext
        
        PID:1060
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        100⤵
        Modifies WinLogon
        
        PID:2168
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        101⤵
        Suspicious use of SetThreadContext
        
        PID:264
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        102⤵
        Adds policy Run key to start application
        
        PID:1984
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        103⤵
        Suspicious use of SetThreadContext
        
        PID:760
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        104⤵
        Adds policy Run key to start application
        Modifies WinLogon
        
        PID:2372
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        105⤵
        Suspicious use of SetThreadContext
        
        PID:1716
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        106⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:2116
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        107⤵
        Suspicious use of SetThreadContext
        
        PID:2920
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        108⤵
        
        PID:2772
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        109⤵
        Suspicious use of SetThreadContext
        
        PID:2576
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        110⤵
        Adds policy Run key to start application
        Modifies WinLogon
        
        PID:2996
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        111⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2924
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        112⤵
        Adds policy Run key to start application
        
        PID:2572
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        113⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1696
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        114⤵
        
        PID:1188
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        115⤵
        Suspicious use of SetThreadContext
        
        PID:1312
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        116⤵
        Modifies WinLogon
        
        PID:948
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        117⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1468
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        118⤵
        Adds policy Run key to start application
        Adds Run key to start application
        
        PID:1132
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        119⤵
        Suspicious use of SetThreadContext
        
        PID:1592
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        120⤵
        Adds Run key to start application
        
        PID:1476
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        121⤵
        Suspicious use of SetThreadContext
        
        PID:1800
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        122⤵
        
        PID:816
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        123⤵
        Suspicious use of SetThreadContext
        
        PID:1632
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        124⤵
        
        PID:1536
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        125⤵
        Suspicious use of SetThreadContext
        
        PID:1976
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        126⤵
        
        PID:1472
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        127⤵
        Suspicious use of SetThreadContext
        
        PID:1532
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        128⤵
        System Location Discovery: System Language Discovery
        
        PID:860
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        129⤵
        
        PID:2200
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        130⤵
        Adds Run key to start application
        Modifies WinLogon
        
        PID:2060
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        131⤵
        
        PID:2044
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        132⤵
        Adds policy Run key to start application
        
        PID:2272
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        133⤵
        
        PID:1692
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        134⤵
        
        PID:2240
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        135⤵
        
        PID:1120
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        136⤵
        Adds Run key to start application
        Modifies WinLogon
        
        PID:1704
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        137⤵
        
        PID:360
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        138⤵
        
        PID:864
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        139⤵
        
        PID:3012
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        140⤵
        Modifies WinLogon
        
        PID:2752
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        141⤵
        
        PID:2760
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        142⤵
        Adds policy Run key to start application
        
        PID:2884
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        143⤵
        
        PID:2764
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        144⤵
        
        PID:2100
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        145⤵
        
        PID:2500
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        146⤵
        Adds Run key to start application
        Modifies WinLogon
        
        PID:2320
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        147⤵
        
        PID:2528
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        148⤵
        Adds policy Run key to start application
        
        PID:2616
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        149⤵
        System Location Discovery: System Language Discovery
        
        PID:2852
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        150⤵
        Adds policy Run key to start application
        
        PID:2716
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        151⤵
        
        PID:2656
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        152⤵
        Adds policy Run key to start application
        
        PID:2976
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        153⤵
        
        PID:2568
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        154⤵
        Adds Run key to start application
        Modifies WinLogon
        
        PID:2516
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        155⤵
        System Location Discovery: System Language Discovery
        
        PID:2504
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        156⤵
        Adds policy Run key to start application
        
        PID:2564
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        157⤵
        
        PID:2964
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        158⤵
        Adds Run key to start application
        Modifies WinLogon
        
        PID:2536
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        159⤵
        
        PID:904
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        160⤵
        
        PID:1660
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        161⤵
        
        PID:2476
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        162⤵
        System Location Discovery: System Language Discovery
        
        PID:2008
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        163⤵
        System Location Discovery: System Language Discovery
        
        PID:428
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        164⤵
        
        PID:656
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        165⤵
        
        PID:1876
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        166⤵
        Adds policy Run key to start application
        
        PID:2904
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        167⤵
        System Location Discovery: System Language Discovery
        
        PID:1628
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        168⤵
        
        PID:992
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        169⤵
        
        PID:572
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        170⤵
        Modifies WinLogon
        
        PID:1420
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        171⤵
        
        PID:1252
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        172⤵
        Adds policy Run key to start application
        
        PID:2480
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        173⤵
        
        PID:1424
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        174⤵
        
        PID:1344
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        175⤵
        
        PID:2204
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        176⤵
        Modifies WinLogon
        
        PID:2076
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        177⤵
        System Location Discovery: System Language Discovery
        
        PID:2344
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        178⤵
        Adds policy Run key to start application
        
        PID:1964
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        179⤵
        System Location Discovery: System Language Discovery
        
        PID:708
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        180⤵
        
        PID:520
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        181⤵
        
        PID:2376
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        182⤵
        Adds Run key to start application
        
        PID:1748
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        183⤵
        System Location Discovery: System Language Discovery
        
        PID:2312
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        184⤵
        
        PID:1856
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        185⤵
        System Location Discovery: System Language Discovery
        
        PID:2948
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        186⤵
        Modifies WinLogon
        System Location Discovery: System Language Discovery
        
        PID:2928
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        187⤵
        System Location Discovery: System Language Discovery
        
        PID:2328
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        188⤵
        Adds Run key to start application
        Modifies WinLogon
        
        PID:2092
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        189⤵
        System Location Discovery: System Language Discovery
        
        PID:2916
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        190⤵
        
        PID:1724
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        191⤵
        
        PID:2316
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        192⤵
        System Location Discovery: System Language Discovery
        
        PID:1696
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        193⤵
        
        PID:1684
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        194⤵
        Modifies WinLogon
        
        PID:888
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        195⤵
        
        PID:2400
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        196⤵
        System Location Discovery: System Language Discovery
        
        PID:2360
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        197⤵
        
        PID:1520
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        198⤵
        Adds policy Run key to start application
        
        PID:1008
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        199⤵
        
        PID:1476
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        200⤵
        
        PID:2068
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        201⤵
        
        PID:816
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        202⤵
        
        PID:1632
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        203⤵
        
        PID:2800
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        204⤵
        Adds policy Run key to start application
        Adds Run key to start application
        Modifies WinLogon
        
        PID:1976
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        205⤵
        
        PID:2164
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        206⤵
        
        PID:1812
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        207⤵
        
        PID:2200
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        208⤵
        Adds Run key to start application
        Modifies WinLogon
        
        PID:2292
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        209⤵
        
        PID:1912
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        210⤵
        
        PID:972
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        211⤵
        
        PID:2288
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        212⤵
        System Location Discovery: System Language Discovery
        
        PID:1880
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        213⤵
        
        PID:1120
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        214⤵
        
        PID:880
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        215⤵
        System Location Discovery: System Language Discovery
        
        PID:360
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        216⤵
        Adds policy Run key to start application
        Modifies WinLogon
        
        PID:2124
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        217⤵
        
        PID:3012
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        218⤵
        Adds policy Run key to start application
        Adds Run key to start application
        
        PID:1676
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        219⤵
        
        PID:2700
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        220⤵
        
        PID:2712
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        221⤵
        
        PID:2764
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        222⤵
        Modifies WinLogon
        
        PID:3028
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        223⤵
        
        PID:2500
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        224⤵
        
        PID:1920
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        225⤵
        
        PID:1712
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        226⤵
        
        PID:2836
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        227⤵
        
        PID:2756
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        228⤵
        
        PID:2520
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        229⤵
        
        PID:2672
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        230⤵
        
        PID:2696
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        231⤵
        
        PID:2976
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        232⤵
        Adds policy Run key to start application
        Modifies WinLogon
        
        PID:2568
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        233⤵
        
        PID:2516
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        234⤵
        Adds policy Run key to start application
        Modifies WinLogon
        
        PID:2504
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        235⤵
        
        PID:2524
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        236⤵
        Adds policy Run key to start application
        Modifies WinLogon
        
        PID:2612
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        237⤵
        
        PID:2972
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        238⤵
        Modifies WinLogon
        
        PID:2956
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        239⤵
        
        PID:2968
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        240⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:1916
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        241⤵
        
        PID:2008
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        242⤵
        Adds Run key to start application
        
        PID:2208
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        243⤵
        
        PID:1844
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        244⤵
        
        PID:2188
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        245⤵
        
        PID:2896
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        246⤵
        
        PID:1080
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        247⤵
        
        PID:1032
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        248⤵
        
        PID:608
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        249⤵
        
        PID:2808
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        250⤵
        Modifies WinLogon
        
        PID:2720
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        251⤵
        
        PID:964
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        252⤵
        Adds policy Run key to start application
        
        PID:2032
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        253⤵
        
        PID:2036
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        254⤵
        Adds policy Run key to start application
        Adds Run key to start application
        
        PID:2040
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        255⤵
        
        PID:2340
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        256⤵
        Adds Run key to start application
        
        PID:2204
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        257⤵
        
        PID:668
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        258⤵
        Adds policy Run key to start application
        Adds Run key to start application
        Modifies WinLogon
        System Location Discovery: System Language Discovery
        
        PID:1204
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        259⤵
        
        PID:2028
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        260⤵
        
        PID:768
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        261⤵
        System Location Discovery: System Language Discovery
        
        PID:2216
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        262⤵
        
        PID:2448
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        263⤵
        System Location Discovery: System Language Discovery
        
        PID:2312
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        264⤵
        
        PID:2236
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        265⤵
        
        PID:2984
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        266⤵
        Modifies WinLogon
        
        PID:2988
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        267⤵
        
        PID:2328
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        268⤵
        Modifies WinLogon
        
        PID:2876
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        269⤵
        
        PID:2776
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        270⤵
        Adds Run key to start application
        
        PID:1636
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        271⤵
        System Location Discovery: System Language Discovery
        
        PID:2192
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        272⤵
        
        PID:944
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        273⤵
        
        PID:1684
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        274⤵
        Adds Run key to start application
        Modifies WinLogon
        System Location Discovery: System Language Discovery
        
        PID:1136
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        275⤵
        
        PID:900
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        276⤵
        
        PID:1132
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        277⤵
        System Location Discovery: System Language Discovery
        
        PID:1668
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        278⤵
        Adds policy Run key to start application
        
        PID:1596
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        279⤵
        System Location Discovery: System Language Discovery
        
        PID:2684
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        280⤵
        
        PID:1800
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        281⤵
        
        PID:2676
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        282⤵
        Modifies WinLogon
        
        PID:1780
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        283⤵
        
        PID:1792
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        284⤵
        Adds policy Run key to start application
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:1048
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        285⤵
        
        PID:860
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        286⤵
        Modifies WinLogon
        
        PID:2848
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        287⤵
        
        PID:2200
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        288⤵
        Adds policy Run key to start application
        
        PID:1328
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        289⤵
        
        PID:2416
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        290⤵
        Modifies WinLogon
        System Location Discovery: System Language Discovery
        
        PID:1652
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        291⤵
        
        PID:1888
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        292⤵
        Adds policy Run key to start application
        
        PID:1880
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        293⤵
        
        PID:2780
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        294⤵
        
        PID:2600
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        295⤵
        
        PID:2724
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        296⤵
        
        PID:1732
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        297⤵
        
        PID:1704
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        298⤵
        Adds policy Run key to start application
        Adds Run key to start application
        
        PID:676
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        299⤵
        
        PID:2648
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        300⤵
        
        PID:3040
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        301⤵
        
        PID:2100
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        302⤵
        
        PID:2644
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        303⤵
        
        PID:2632
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        304⤵
        Adds Run key to start application
        Modifies WinLogon
        
        PID:2320
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        305⤵
        
        PID:2616
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        306⤵
        Modifies WinLogon
        System Location Discovery: System Language Discovery
        
        PID:2704
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        307⤵
        System Location Discovery: System Language Discovery
        
        PID:2844
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        308⤵
        
        PID:2520
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        309⤵
        
        PID:2508
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        310⤵
        
        PID:3052
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        311⤵
        
        PID:752
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        312⤵
        Adds policy Run key to start application
        
        PID:784
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        313⤵
        
        PID:2548
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        314⤵
        
        PID:2516
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        315⤵
        
        PID:2544
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        316⤵
        
        PID:2332
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        317⤵
        
        PID:2128
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        318⤵
        Adds Run key to start application
        
        PID:2468
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        319⤵
        
        PID:1324
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        320⤵
        System Location Discovery: System Language Discovery
        
        PID:2472
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        321⤵
        
        PID:920
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        322⤵
        Adds policy Run key to start application
        
        PID:2900
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        323⤵
        
        PID:2208
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        324⤵
        Adds policy Run key to start application
        
        PID:1844
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        325⤵
        System Location Discovery: System Language Discovery
        
        PID:1192
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        326⤵
        Modifies WinLogon
        
        PID:1628
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        327⤵
        
        PID:1988
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        328⤵
        
        PID:1032
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        329⤵
        
        PID:608
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        330⤵
        Adds policy Run key to start application
        
        PID:2808
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        331⤵
        
        PID:2784
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        332⤵
        
        PID:2584
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        333⤵
        
        PID:1360
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        334⤵
        Adds Run key to start application
        
        PID:912
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        335⤵
        
        PID:1144
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        336⤵
        Adds Run key to start application
        
        PID:1452
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        337⤵
        
        PID:2344
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        338⤵
        
        PID:668
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        339⤵
        
        PID:524
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        340⤵
        Modifies WinLogon
        
        PID:1984
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        341⤵
        
        PID:2440
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        342⤵
        
        PID:1804
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        343⤵
        
        PID:2216
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        344⤵
        Adds policy Run key to start application
        
        PID:1748
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        345⤵
        
        PID:2312
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        346⤵
        System Location Discovery: System Language Discovery
        
        PID:1416
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        347⤵
        
        PID:2772
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        348⤵
        
        PID:2936
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        349⤵
        
        PID:2988
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        350⤵
        Adds Run key to start application
        
        PID:2256
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        351⤵
        
        PID:2876
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        352⤵
        Adds Run key to start application
        
        PID:2776
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        353⤵
        
        PID:1636
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        354⤵
        
        PID:968
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        355⤵
        
        PID:748
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        356⤵
        Adds policy Run key to start application
        
        PID:1684
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        357⤵
        
        PID:1136
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        358⤵
        
        PID:316
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        359⤵
        System Location Discovery: System Language Discovery
        
        PID:892
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        360⤵
        Modifies WinLogon
        
        PID:1404
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        361⤵
        
        PID:1008
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        362⤵
        Adds policy Run key to start application
        
        PID:1544
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        363⤵
        
        PID:816
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        364⤵
        Adds policy Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:1800
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        365⤵
        
        PID:2800
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        366⤵
        Adds Run key to start application
        
        PID:2264
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        367⤵
        
        PID:2164
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        368⤵
        Modifies WinLogon
        
        PID:2152
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        369⤵
        
        PID:860
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        370⤵
        Modifies WinLogon
        
        PID:2352
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        371⤵
        
        PID:2272
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        372⤵
        Modifies WinLogon
        
        PID:2072
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        373⤵
        
        PID:2416
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        374⤵
        
        PID:1412
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        375⤵
        
        PID:2240
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        376⤵
        
        PID:588
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        377⤵
        
        PID:1020
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        378⤵
        
        PID:880
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        379⤵
        
        PID:2600
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        380⤵
        Adds policy Run key to start application
        Adds Run key to start application
        Modifies WinLogon
        
        PID:2724
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        381⤵
        
        PID:1732
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        382⤵
        Adds policy Run key to start application
        Adds Run key to start application
        
        PID:1704
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        383⤵
        
        PID:1560
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        384⤵
        Adds policy Run key to start application
        Modifies WinLogon
        
        PID:2728
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        385⤵
        
        PID:2748
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        386⤵
        Adds policy Run key to start application
        
        PID:2100
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        387⤵
        
        PID:2768
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        388⤵
        
        PID:2300
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        389⤵
        
        PID:2692
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        390⤵
        Adds policy Run key to start application
        Modifies WinLogon
        
        PID:3028
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        391⤵
        
        PID:2716
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        392⤵
        Adds Run key to start application
        
        PID:2664
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        393⤵
        
        PID:2012
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        394⤵
        Modifies WinLogon
        
        PID:2496
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        395⤵
        
        PID:540
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        396⤵
        Adds policy Run key to start application
        
        PID:936
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        397⤵
        System Location Discovery: System Language Discovery
        
        PID:2548
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        398⤵
        Modifies WinLogon
        
        PID:1688
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        399⤵
        
        PID:2544
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        400⤵
        Adds Run key to start application
        
        PID:2112
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        401⤵
        System Location Discovery: System Language Discovery
        
        PID:2972
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        402⤵
        System Location Discovery: System Language Discovery
        
        PID:1764
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        403⤵
        
        PID:2968
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        404⤵
        Adds Run key to start application
        Modifies WinLogon
        
        PID:2588
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        405⤵
        
        PID:1508
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        406⤵
        
        PID:2148
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        407⤵
        
        PID:656
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        408⤵
        
        PID:2208
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        409⤵
        
        PID:2904
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        410⤵
        Adds Run key to start application
        
        PID:1640
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        411⤵
        
        PID:2212
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        412⤵
        Adds policy Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:1420
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        413⤵
        
        PID:2788
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        414⤵
        
        PID:956
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        415⤵
        
        PID:2784
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        416⤵
        
        PID:2032
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        417⤵
        
        PID:1980
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        418⤵
        
        PID:2040
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        419⤵
        
        PID:1144
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        420⤵
        Adds policy Run key to start application
        
        PID:2076
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        421⤵
        
        PID:2344
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        422⤵
        
        PID:1204
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        423⤵
        
        PID:2168
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        424⤵
        Adds policy Run key to start application
        
        PID:1904
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        425⤵
        System Location Discovery: System Language Discovery
        
        PID:2052
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        426⤵
        Adds Run key to start application
        
        PID:2088
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        427⤵
        
        PID:1140
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        428⤵
        Adds Run key to start application
        
        PID:2744
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        429⤵
        
        PID:768
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        430⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:2116
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        431⤵
        
        PID:2576
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        432⤵
        
        PID:1952
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        433⤵
        System Location Discovery: System Language Discovery
        
        PID:2944
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        434⤵
        
        PID:2328
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        435⤵
        
        PID:1724
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        436⤵
        Modifies WinLogon
        
        PID:924
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        437⤵
        
        PID:1636
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        438⤵
        Adds Run key to start application
        
        PID:1188
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        439⤵
        
        PID:1468
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        440⤵
        
        PID:1180
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        441⤵
        
        PID:1476
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        442⤵
        Adds policy Run key to start application
        
        PID:1088
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        443⤵
        
        PID:1408
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        444⤵
        
        PID:2068
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        445⤵
        
        PID:1536
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        446⤵
        Modifies WinLogon
        
        PID:3020
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        447⤵
        
        PID:1656
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        448⤵
        Adds Run key to start application
        
        PID:1532
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        449⤵
        
        PID:860
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        450⤵
        Adds policy Run key to start application
        
        PID:2200
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        451⤵
        System Location Discovery: System Language Discovery
        
        PID:3000
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        452⤵
        
        PID:1328
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        453⤵
        System Location Discovery: System Language Discovery
        
        PID:1720
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        454⤵
        
        PID:2244
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        455⤵
        
        PID:1548
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        456⤵
        Adds policy Run key to start application
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:588
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        457⤵
        System Location Discovery: System Language Discovery
        
        PID:360
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        458⤵
        
        PID:880
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        459⤵
        
        PID:3012
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        460⤵
        Adds policy Run key to start application
        
        PID:2308
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        461⤵
        
        PID:2700
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        462⤵
        Adds policy Run key to start application
        
        PID:676
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        463⤵
        
        PID:1580
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        464⤵
        
        PID:3048
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        465⤵
        
        PID:2500
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        466⤵
        Modifies WinLogon
        
        PID:2100
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        467⤵
        
        PID:2732
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        468⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:2300
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        469⤵
        System Location Discovery: System Language Discovery
        
        PID:2176
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        470⤵
        Adds Run key to start application
        
        PID:3028
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        471⤵
        
        PID:2660
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        472⤵
        Adds policy Run key to start application
        
        PID:2012
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        473⤵
        
        PID:2512
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        474⤵
        
        PID:792
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        475⤵
        
        PID:1740
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        476⤵
        Modifies WinLogon
        
        PID:1992
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        477⤵
        
        PID:2156
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        478⤵
        
        PID:2960
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        479⤵
        
        PID:2612
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        480⤵
        
        PID:2980
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        481⤵
        
        PID:1708
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        482⤵
        
        PID:2472
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        483⤵
        
        PID:920
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        484⤵
        
        PID:428
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        485⤵
        
        PID:656
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        486⤵
        
        PID:2896
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        487⤵
        
        PID:1860
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        488⤵
        
        PID:1192
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        489⤵
        
        PID:1640
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        490⤵
        
        PID:2212
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        491⤵
        
        PID:1252
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        492⤵
        
        PID:2788
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        493⤵
        
        PID:1424
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        494⤵
        
        PID:1080
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        495⤵
        
        PID:2032
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        496⤵
        
        PID:1980
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        497⤵
        
        PID:2592
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        498⤵
        
        PID:1060
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        499⤵
        
        PID:468
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        500⤵
        
        PID:524
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        501⤵
        
        PID:2168
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        502⤵
        
        PID:2432
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        503⤵
        
        PID:2028
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        504⤵
        
        PID:1804
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        505⤵
        
        PID:2460
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        506⤵
        
        PID:2992
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        507⤵
        
        PID:3004
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        508⤵
        
        PID:2252
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        509⤵
        
        PID:2872
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        510⤵
        
        PID:1952
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        511⤵
        
        PID:2928
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        512⤵
        
        PID:2876
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        513⤵
        
        PID:2776
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        514⤵
        
        PID:1312
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        515⤵
        
        PID:748
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        516⤵
        
        PID:2064
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        517⤵
        
        PID:1516
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        518⤵
        
        PID:1596
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        519⤵
        
        PID:824
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        520⤵
        
        PID:1632
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        521⤵
        
        PID:2336
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        522⤵
        
        PID:1472
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        523⤵
        
        PID:2060
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        524⤵
        
        PID:1812
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        525⤵
        
        PID:756
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        526⤵
        
        PID:2044
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        527⤵
        
        PID:568
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        528⤵
        
        PID:2416
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        529⤵
        
        PID:1888
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        530⤵
        
        PID:2004
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        531⤵
        
        PID:864
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        532⤵
        
        PID:2160
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        533⤵
        
        PID:1672
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        534⤵
        
        PID:2220
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        535⤵
        
        PID:1084
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        536⤵
        
        PID:2760
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        537⤵
        
        PID:1588
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        538⤵
        
        PID:2884
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        539⤵
        
        PID:2748
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        540⤵
        
        PID:2196
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        541⤵
        
        PID:736
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        542⤵
        
        PID:2708
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        543⤵
        
        PID:2732
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        544⤵
        
        PID:3008
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        545⤵
        
        PID:2176
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        546⤵
        
        PID:2492
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        547⤵
        
        PID:2660
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        548⤵
        
        PID:2976
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        549⤵
        
        PID:3060
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        550⤵
        
        PID:784
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        551⤵
        
        PID:936
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        552⤵
        
        PID:2656
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        553⤵
        
        PID:2564
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        554⤵
        
        PID:548
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        555⤵
        
        PID:2536
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        556⤵
        
        PID:904
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        557⤵
        
        PID:2968
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        558⤵
        
        PID:1708
        
        C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wcsydrv.exe" a
        559⤵
        
        PID:1660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\wcsydrv.exe

Filesize
73KB

MD5
074c415b7ff6216759269472e63ef44d

SHA1
238dfa827dcaa7ac3f48d30909abd20ecfedbb8e

SHA256
e776bac009401a8690377b7b49ba6ff61aea4eea48e1d3f208284556292fefc3

SHA512
8b93a53a7620a069ac046484f6c3ace792a8e83b6425d90de4b582f03d2dae3d2e531754708d4d7b9e2b5189b070f734cba9f43f084d11fd6615d5c9cb4ff81b

Download Submit
memory/360-133-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/588-125-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/760-94-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/1088-119-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/1156-70-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/1508-53-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/1640-65-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/1684-113-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/1732-135-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/1776-121-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/1792-123-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/1944-131-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/1960-117-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/2040-83-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/2072-127-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/2252-100-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/2288-129-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/2304-47-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/2316-111-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/2348-59-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/2400-115-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/2412-109-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/2460-89-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/2556-41-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/2576-106-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/2660-35-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/2672-29-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/2688-77-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/2700-137-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/2728-0-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2728-13-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/2728-2-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/3052-23-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/3052-19-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads